Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 13:45

General

  • Target

    2024-06-12_410fec919becb7842cbd7daf40aeee0c_bkransomware.exe

  • Size

    1.8MB

  • MD5

    410fec919becb7842cbd7daf40aeee0c

  • SHA1

    e98540db6dd523a9fe10b45912f7b4381d0f2edc

  • SHA256

    9d085ced726fe07d7266e2d3c3300d2397c8325f4756d830f76848550b832a9c

  • SHA512

    bbc90d1609965c4a39214f6f6ac2f656de0ed801154e13994c3ecbfa2f112417734b194c71ad92912340726f1bc504775dabf3c0c54d0022aa3f44b657142293

  • SSDEEP

    49152:uE19+ApwXk1QE1RzsEQPaxHNU/snji6attJM:T93wXmoK8EnW6at

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_410fec919becb7842cbd7daf40aeee0c_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_410fec919becb7842cbd7daf40aeee0c_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:372
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4324
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4572
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4704
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5064
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1556
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4164
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3600
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3624
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4744
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4668
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4256
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3444
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2156
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3388
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3812
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1040
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1044
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1112
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4728
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3632
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1424
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2316
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5356
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:5380
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:5192

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

          Filesize

          2.2MB

          MD5

          b9bf82ce3b529fcf9f84694d9a194164

          SHA1

          cffaf138dff4b2b09d8e73f43c09a4adc9803a6e

          SHA256

          88eea2aae6330e62a22384f95839d4a5de48c40da2dd4c0206409f178ea6132a

          SHA512

          1d554e93a4d19bc60598a2d0af69a5b954bcf94a051271b71ba2698225d686e275544af01a54782618f4dc1efef4021a28a7f135e7c838c5ffab264ec37769ea

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

          Filesize

          1.6MB

          MD5

          ba939fa54a2a27e7f3af158b888f9e10

          SHA1

          13fa6974fadacb96f260bb228f586ccff2fb2c5c

          SHA256

          d7dc549e8a42dd20e3f03a91cdf818e9e439966535761e3b6304add6adf30c60

          SHA512

          d5124a74a553df679217904ae077482faaf6c0f4ba1dd8003b0d061eec04ac951109434eebab4d0ea73320f4cfbab83af38cf819a008d0693f07a876c643b176

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

          Filesize

          768KB

          MD5

          bd62d0ef8206ecdedfa6482006502b7c

          SHA1

          f387507134de0296eef253e2973146bd5604def4

          SHA256

          920137484d7330ac248d0c1d3a2c8300429c910f4846122c6454145f2a26648a

          SHA512

          5ccac4b8bd318b41249cb1f3445d2b33f4489037b15682a084aa87ee6fed96d0dc36dd7b40f5fc817c22aaffb237aed59ead673392304ce5915b5a0ffdeba8c5

        • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          1.7MB

          MD5

          1714347c1face890dd0ab34cb7b109e6

          SHA1

          1da027b89810b7a41b7898d00bd39ee90ccf3adb

          SHA256

          1fb0169be1e57bc02e385c343ce2bd2c06b5e04919d4972cb41ff7b9a340dad4

          SHA512

          d560975d126a88a633ee7bc0dbe22a57b81b0617d5a7a62290e34555fe612b27b9091f4783b691a4c03d9cbe7a8e836a94c6aee8ed9b09bd127cc2fee600f723

        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

          Filesize

          704KB

          MD5

          8084485b0014f53f974ce6f03568486c

          SHA1

          910ad7358750c064ce075eaef5c5e222d08d92cf

          SHA256

          25cef448dcecaa4e04f88babef5090f4fdc191d4b249a0b907f7e18f7a9ca9ea

          SHA512

          543be4df1b4eb3e38282c4d95fce3d03d525d24dfb9708857f276e31fa7fbf9dc2b1975d9e1c4f6a945565fce34e84361c74b4e94151872fafd77b3243828a49

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

          Filesize

          640KB

          MD5

          9a7b8f895bc74f6adaf76e995a856b46

          SHA1

          a61dceeac4aeb422430f1f7cf8b3c0c194981289

          SHA256

          2f7c1dcdca22506166affe461d8bd2860fb034a6771712e74c71c524c03c61e8

          SHA512

          8c5b84c42fdcc304df3e41457dee621426e34e2223c9013e989d8d07c73068e5032ee516795bd3849a572d5f5d85efab6f2e6afe88c866bc908411604ef40c6b

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          2.1MB

          MD5

          a29ae52baaed383b4ffe28bbc1fe972c

          SHA1

          12020d8fe134c4ef8b76f53700942b83c42b29f4

          SHA256

          544e2b0412774f8d7f055d4eb7b59b582250981c5afc8ce285f43ae81893ea3b

          SHA512

          9737c1f71d8e2436cde1116c393d7bf973d74875da9073f593196398827f1ccdc6bb54931f37c0d757485c97841b74b92f6f95681e835cccddad00969fc79295

        • C:\Program Files\Java\jdk-1.8\bin\jar.exe

          Filesize

          576KB

          MD5

          1b4a3daee1e4d09e9a15b193df99fb8b

          SHA1

          265be337fb131e6c4ae4026138ef5f1efdaa2713

          SHA256

          2cd56aa00749cb7ea8010f9572f5702c030b12cf3e58e927088703641513eb60

          SHA512

          6a93324093821ae7a2610ab3cbd500967c94db6fe85be43c4d1a9831c095c37f23725826596c1011740ce9d4ce08f8c89f0c0066a6c04418ccd9f12c62af8827

        • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

          Filesize

          576KB

          MD5

          c72de033e3ea30d7537fa1a7c8b2774d

          SHA1

          b417a3e07e057b3ca9f3514cc9edd8a2de985961

          SHA256

          0946e097f12a5b607c070c822d81f8ac8f7d0a69dca2d77b9e95c1eacdba67d9

          SHA512

          1bd3bf3aedf455a92394e36ffdc0c879903b64803c8430e9ce3a33ec9e53ad66b340e6a193666b7b4df604536da4037007fecada05c89587eb1f959180afdcd9

        • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

          Filesize

          576KB

          MD5

          50d00c5d8293c0883f47a136efd0cbc6

          SHA1

          c89103b68d3f08a11266eb607d4c94576c4f7a3d

          SHA256

          bdb4ec08bb15bf1f56235c358580afc6e49ba754cba75e838f51ea435d4c0008

          SHA512

          323393da795656587e3f8d38ea7955f2419438656198b8ffa6dc4127560d0647ae14d66a2da027c76fc1e0dbe18fa2f0073566e19b06e1e9af3aa3e253931e94

        • C:\Program Files\Java\jdk-1.8\bin\java.exe

          Filesize

          576KB

          MD5

          25acc44ed902aaa21d540cb197a6269a

          SHA1

          ace569b34cf48bc7cdee46df4ed6e13fc4488ed6

          SHA256

          652645c42b982badbb02dde4f7ed4eefb3bf5b098e77da132110f2ea2ca35702

          SHA512

          c7ffd2accc5456e789c438a1060edfb6e09475c33e56931040274c1a80cca69c34db1a0e60958ed3f6536f38f1c6bcd20349ae282432e6c8fe39c86f5bd5c7d2

        • C:\Program Files\Java\jdk-1.8\bin\javac.exe

          Filesize

          576KB

          MD5

          30a81dba6932d7fb4cca501cdea4f342

          SHA1

          3ef9381eae0f0f5e42a9e9bbd354ade44af9fffc

          SHA256

          4d7200ec01a4830a8c71fb857a5328a9181ffde0b98748a7e54533301f140e8b

          SHA512

          8858e7e2f8e10c11f901c85a8bb1f8e4b6533196f946e7defbd9a3de8302ec462750fdcf225179d1cf4efe321d5a5f30dabd433be975e9ea12850ecd6b94eab8

        • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

          Filesize

          576KB

          MD5

          f3c5c290e76fa02b447ca55dfb9e570b

          SHA1

          69ff1c7677fc2f231ff381f0c73ba31fce1e0f5c

          SHA256

          c793d0260b7d1375d3a10b558a40bb9a18951b86b197724869f5361889cfac73

          SHA512

          64fc7663be6d2955ccb268b79a74ba85fb2f9e5f25f51a09905494e9a05f076e8682a6ee252e8991b11073afef903b70b92e381bcb96cb444eccc54a0f36e9da

        • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

          Filesize

          576KB

          MD5

          52a9df7fb2fcf510a27e5f0c0979ccb7

          SHA1

          deb71ecd20188991e7dce1cdd830c4c0771f3579

          SHA256

          2e11082cfa6744bf03fcc001dbe461986cbd43ba674faf02d867ae7848b8c6cd

          SHA512

          3a7d272b821a5374d510c0f0f1363bd6adae699cb86d1d2d17c9cb40429a86d39071f26267591842dc9a03b817398f8282742226c56640c7e1f05b8368bd6aba

        • C:\Program Files\Java\jdk-1.8\bin\javah.exe

          Filesize

          576KB

          MD5

          3f6f730f1d7e920b3d3eea4f37a03c14

          SHA1

          67eb2d7ccde7b08a46256b1d271e6d9eadd68faf

          SHA256

          c0da03a5d307602fba9406adb6169c31a9b3aaae2ebd848a39cf7a00095458c9

          SHA512

          4609241c496969e43c1b95b52daa4cc9c4149e7651d7c9f97cf6428d325fdfea70d05cfaff55da74e53f57baee29aa37912be7e3a9925f1a459cf0a8037c333f

        • C:\Program Files\Java\jdk-1.8\bin\javap.exe

          Filesize

          576KB

          MD5

          ece5190e4a6faa016973c1fd601d6041

          SHA1

          a86a5af208e361edfa32b45e6abfb286befe06cf

          SHA256

          4d21988161ae8904063440c87e48edb8988eca041f4990213a4d6d370ac829df

          SHA512

          98b86e08d5b68c2d51199307af7536225dde12478e9388f605189d936aa38842dda3086e98433a4c8d65799a69d8c88f2eda289c814cde4c24d0a59ff732abcd

        • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

          Filesize

          576KB

          MD5

          88dc60bd55c27eb3dd66ee1b982a4b82

          SHA1

          2d2f08f13932f9dd0b9095d2f2808221801e1625

          SHA256

          e9dbd456b8bf3efc26f0c3cdeb6c1a3f762a21443a3fc2788f96e2b2b3b582d0

          SHA512

          e5322fa40455255bdad5a2b2a0a206c8e4c021f094685e86e7533dd9a34bedac5a0dc05a8b9136418de089c169475f6b71714b07d82f7d6e480ef42e3ba583b0

        • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

          Filesize

          557KB

          MD5

          3761436c085b1822246257d896ccb49b

          SHA1

          f58a3f8fbd1463e9e28ce8ab35d38cf123d9dc35

          SHA256

          4517b56bdcca9f07805d15368d102d83a1679b749b409f876dff529d184a8096

          SHA512

          c49c5aef65941d60c75d428b083844b8b490af506adbf4c43a692a6f1b37c6c2edecc593bb3ae68dab0ba34f190120c9c1f28cda6eca96d5145b5ab18d76e589

        • C:\Program Files\Windows Media Player\wmpnetwk.exe

          Filesize

          1.5MB

          MD5

          5dba90952e01683508a49d994b6d8cd6

          SHA1

          2cff00b9e6f128fb7b6de3ad86b593c135462408

          SHA256

          8a735de8e38a3e3764c3c9f75f1e4041e8520e76ff2074ac0b5ad93f592046db

          SHA512

          5fd9e18fc79d7ca7309f1538061df3989660c38a34f7dec8c23489d62610828b1da2a6495991334074cf4342f94899f498263d4d724b6e01bfa6a8efce1ff7dc

        • C:\Windows\SysWOW64\perfhost.exe

          Filesize

          1.5MB

          MD5

          bb47e7d2eb1486f655c319b23fe7d11b

          SHA1

          e8597090545026c926d89cf779f52655367d7cc1

          SHA256

          6fd6d9cde143c836d6d8cc178d7df40098d19ac6a8d8b6670251d89ddaa75778

          SHA512

          ec9cd864cc9509da93b43a90c467766c114cc24f5e836fdecc39f2315f1c39260f4ae416abaa421d6a2be5205b527763da15398d4a95e23104860dbea757dc33

        • C:\Windows\System32\AgentService.exe

          Filesize

          1.7MB

          MD5

          ee21b5f2503dd8f7bd3ab3c20311d0cf

          SHA1

          bd74e4d17d53c6e09c98a3aa0dd7a2ec3a9f4590

          SHA256

          e9f33057c76728b19de53661a3f7fc3c1cd7c3a481f477a4d5663dbccdda7ed6

          SHA512

          79b3d49449e602bd58eb8d36e88e0ddce85b7c33c08b2e60504bd0d16399ff53b5ead68bf0657ff83001b0cbff42d84d584263c1fef11229313d91575b1e47f7

        • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

          Filesize

          1.5MB

          MD5

          777916edc8e131f29080ed7a563e979f

          SHA1

          804e71965e29e217e363e30ca7639f78bf73579c

          SHA256

          654f8e80f37eb5d544a27d30423dcb3b861ad1d0aae1de0429107b71c9fa371b

          SHA512

          abf08249ddc6f590ad4aad5f76fced5ddd801609ccd29456852a26749d3a828c63f909ba6402caed1ad40f417b5d75dcd9eeacf55011276d8888ded80e77e2dc

        • C:\Windows\System32\FXSSVC.exe

          Filesize

          1.2MB

          MD5

          f73fe40f1930a38f8b294aeae7c624d3

          SHA1

          f9784f9115f05614367a718af5e4517d65a26d0a

          SHA256

          c358cf7d985c614eee62806a017855809331b8c2ed1d07cacba3bc3b61384e13

          SHA512

          b6a4fb22faeb49a943e1e539b56eaafb1befb1357e1116b714021ce06d07a0351d7445de19fd61008554f64e98cc31fa28bbde06a153721739936044e549e619

        • C:\Windows\System32\Locator.exe

          Filesize

          1.4MB

          MD5

          62165934269a4fc752b7bca4eab1a639

          SHA1

          f9d56cb16c59e5e8ee04475a4766ad50c0933eb2

          SHA256

          ea97272f2152eeb47ccdf8f7899aadc28f4efa0e6f6aa912789d0f8fe5ad5487

          SHA512

          9cd9d38a09788ab233ca443e5f7ca785d2d434b82c493a10d8a8a9953e3a5f2f00544e42dc37450e323179c66601c777368d73467e53895c7e16287a54e0b4eb

        • C:\Windows\System32\OpenSSH\ssh-agent.exe

          Filesize

          1.8MB

          MD5

          841af7c46e2102f6e4686132449f2a58

          SHA1

          1080597189ee98f6a37c04be563a252d4bbb9c32

          SHA256

          4aaf3b8ca83ecb2e1e3dd01d7e10e018ab94183314b44925819e944212904ed5

          SHA512

          5fe71c2a1579cd708a6759c5a7b2013aa6d8a9a7765fef5669a2bc8bc08604234b3a4672f886a826e1679d39148b593a967e869d50b1f62d49f7bdd2725e20d2

        • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

          Filesize

          1.5MB

          MD5

          ca5550a46fc28fd5a241d2c869241413

          SHA1

          779902bd3a6a6faddfa7b9c3d0384611a905fda1

          SHA256

          efcb92aab291c8a15d4b9a6e85c5d5338889b105d17f593063a38250891d9227

          SHA512

          2b4328d799f58fd6db98af94516eed25071b853069fb6bc752b4ab3bfed7159e1b81a52fd03ea42520d6431e1a9593c57d22bee128c4303f35ffc03f84676170

        • C:\Windows\System32\SearchIndexer.exe

          Filesize

          1.4MB

          MD5

          b328400a4fd75c88bb210003214fadce

          SHA1

          c18c18fff85416a3c4c789fc51ddf0590b178818

          SHA256

          ed55624a6a5928870d56f2730d0c6d58f1ec29d63bdd5f626bbe368c1405d85e

          SHA512

          34de98183f7711a1895587e23cbecebe319324307ed9f20bbc3e180f9d2bed01c43f1beda40d2f4263485ac149c6dc2c6a78e049da69a73403ace95673df3acf

        • C:\Windows\System32\SensorDataService.exe

          Filesize

          1.8MB

          MD5

          49099cb846e450ce4129354bc669244c

          SHA1

          485d6a49f020ce9f2abe5dc30a20e10716042ff1

          SHA256

          403fe101cb3359afd4059eaeb79b37f8edf168fbee9e07829d0830ce8290937b

          SHA512

          e7c0f805c2e43553675d271fcc2adfad96df830d5784b37299f55954d532add084f3df103b32fe92f9ca6a1dc9ce5bd7dfb2dbacb46157eb9646e0bc0e2e1d73

        • C:\Windows\System32\Spectrum.exe

          Filesize

          1.4MB

          MD5

          1f2491047a3897f06533054169fbef39

          SHA1

          716fa55e03f1450bb61c83b31085760cbedd17b6

          SHA256

          084938297a8dc5398858b08f0c62898a29e19ccb070ccfe585f5e88026d34e97

          SHA512

          356e468f1439169695ac981d0155a114bf276bc0406d5bb6252df78c7cb062943d557ac0ad320613ca09651997dac8048b389a8a361a83dd76d2c84e223f74f5

        • C:\Windows\System32\TieringEngineService.exe

          Filesize

          1.7MB

          MD5

          51ee45037c4a7fab4f4eaa87498394c0

          SHA1

          35118aa24f7cd6638d04d7d99f8ce7f1ccd793e3

          SHA256

          bb8bd35448c60c0d2fdf2396e0ba22eb55ef359bbe4d639f28d71453f1260193

          SHA512

          dde8ab5b8d692970b7c5f1887762824031ec83857adbf096800d32bfa26e348268028514de2787f1c2ed0df8cbff525a43894bf37039e9ece78d7abf2b7cfb20

        • C:\Windows\System32\VSSVC.exe

          Filesize

          2.0MB

          MD5

          88a47db0b65c4487fce9f794c631e797

          SHA1

          903ba876c1d63fbfd1ec97684f282e321088ef62

          SHA256

          abae62f67f96abf32cb6806fb00617afbf13318991cd7ed67c3bc241deca5d6f

          SHA512

          aaccd527fdab74b33cad662b42fca02043bb8080b23d27a3b71ca78ccc6f8f28a7baea3a6607f4e4fb1c0cb91c0e10ea15fa18948362c5e1b72d562080343af8

        • C:\Windows\System32\alg.exe

          Filesize

          1.5MB

          MD5

          e16ccebadcb495ab853d674241d514c8

          SHA1

          65ba18dcc2a759d8b975d3f661c7f0319fbe8c62

          SHA256

          454cc40ff7b928636ed1247f83c508172df8eef86ae27ece9b57973bc46687b1

          SHA512

          de7b4fb74178fbb3459339b90ccababe1b5afa461086961988a9237a1f4121711df640c4f20c8e7072585ff7a956e15461e9a55c5f9ceb609644d419f883f7c4

        • C:\Windows\System32\msdtc.exe

          Filesize

          1.6MB

          MD5

          acf9b07441f146bf63ce09f5168425b2

          SHA1

          a57dce166852cf220211b47d15149a31940d2a0f

          SHA256

          fec83f36c75de1da1268d0824df75e427a26fd126e9458755a8be71036fb6592

          SHA512

          9e1d4868575f5a98d2951debc8fe1b9ba677bc1fda5282f82319477d713b6dd8912a4e30a5d931bd66f5a294e7a27abfefe605f624d1e545d3230708629d22ea

        • C:\Windows\System32\snmptrap.exe

          Filesize

          1.4MB

          MD5

          234d35f4fe63c8862d936a2676667b4e

          SHA1

          36bc7b75ee66cdcff5abd6f51974afb48aefd8a9

          SHA256

          a8a0fa6ded9645afd5fb5558313f20084147960fff6935f25e4f0d87808a2bca

          SHA512

          54a90cb3173fd37a69892504e9fc5277e579db2f1b146549738e851b05b2391cbab8621ea3770858c4d311a2e2183e9b217dd36d4bf3b7a2ec89f01a91490685

        • C:\Windows\System32\vds.exe

          Filesize

          1.3MB

          MD5

          cdba8566b4622dcd9c85d0de014686d6

          SHA1

          e57234bbb41c8d4a763a2ebaad1310aa8d1e98b9

          SHA256

          e3beb8778e3c8c1f4372cb1688bb61f3f284be687d0425d7dabf4ffe3960465c

          SHA512

          f04027371f973a8d32fa68c9a9d1a2942d43d9c3d52a84351deece08be74514f6d81f7f84ec08b1b931c140adf654895805f866a29d6e4dae576c8056ec4047b

        • C:\Windows\System32\wbem\WmiApSrv.exe

          Filesize

          1.6MB

          MD5

          b6ae013884becf3f1d6ca6a034a0f7c4

          SHA1

          2263020ecba1e38aabf0cef7b442f84865905895

          SHA256

          4fc1aefb46df69cbcea31d9550ffdaf7c366729f8cddbfc50f9c9b45e6c190d8

          SHA512

          c83409f805b5dd5be5c65a84c582c50f3c37b7e334ed6c9f48c2fd4e06a0c127d37cf6a823d3e80d777376e088c2b60bd610b92b7e4514ec4305755ce6994bac

        • C:\Windows\System32\wbengine.exe

          Filesize

          2.1MB

          MD5

          2c1fc2056560eaea5311e280ef06af17

          SHA1

          5bee8bae8b804687fe4a5b10b649a0b15dbdd62a

          SHA256

          0661c12c4f6712bc126190a55f78f213387b1506cce453e2f2b92de333288a81

          SHA512

          b9383a8d1a7de26ec417f02870ecef9e9859cae3ec0f39e424702a2841211703dd988d449dbd23b0f52b34b297e36a70467c0e9922182ad54896e5a10d329cbc

        • C:\Windows\system32\AppVClient.exe

          Filesize

          1.3MB

          MD5

          8b53e6e10d829d287756876402b9c689

          SHA1

          9efba727c3924b9a5571e1d24cffd0b6d3bc2a89

          SHA256

          85306cb870db66aa25be8d5f9b3b078416b557973eae9a777f44245a154af362

          SHA512

          6b141e0be8f2fd24db95e2cd18a79ba3043dab010b5301f3b511c47448204d45cad7ba4375e98c4f3855175e86fcb36599a63d20a3824c687eef533e7ecd2de2

        • C:\Windows\system32\SgrmBroker.exe

          Filesize

          1.7MB

          MD5

          3895f49a78cd18d957999fe6327d13d6

          SHA1

          bdb6d713cddace1902b814db746eaef0a527eff9

          SHA256

          ebed2d43f94d276863acd123b2c78a03a6cb0fb2049df116c365f563671dd67c

          SHA512

          5fafd5d404b352fc4a6a9eacdf7bc6503e223f69bc51944e649b72b48376a28a0ed28a8e3a9cb66838098fc2ac62246b7d12ecf905e094e67a75008fb75d6c79

        • C:\Windows\system32\msiexec.exe

          Filesize

          1.5MB

          MD5

          d55a4d3def204c20a3bcaf2e26d9184d

          SHA1

          f4026ef0a7ce52df0822cf784a97609ba81dfae1

          SHA256

          e2dabcf8ae7c6112c010bd463cfc6a37f09424bb04325e57c631b9bc5c78c51f

          SHA512

          5b2f8d28110be626f5289b52e5f5be27551d1acb37a45581df22148fce5124bf700bd8da6ada1276564660068db6952b04b13fe1babaf603e5cffc233f53ab98

        • C:\odt\office2016setup.exe

          Filesize

          2.8MB

          MD5

          d5becf4dc8a11e5bf40c239e17033ccd

          SHA1

          a34dc6299110daefeed447debcd811061ce1c0c2

          SHA256

          a239b7b4f769ed1254c6696f70c36d48cceed4b491641a295c87b45459f33698

          SHA512

          8b4f6e2b6b5450f6a0d66146b6dfce0e4479117581866c33c1115a6b8c768eb1f88dfd6943f7070256ba255b54711a9e44ded03ad1b0509ccb660c92885b13a4

        • memory/372-6-0x00000000024A0000-0x0000000002507000-memory.dmp

          Filesize

          412KB

        • memory/372-0-0x0000000000400000-0x00000000005D9000-memory.dmp

          Filesize

          1.8MB

        • memory/372-75-0x0000000000400000-0x00000000005D9000-memory.dmp

          Filesize

          1.8MB

        • memory/372-7-0x00000000024A0000-0x0000000002507000-memory.dmp

          Filesize

          412KB

        • memory/372-1-0x00000000024A0000-0x0000000002507000-memory.dmp

          Filesize

          412KB

        • memory/1040-377-0x0000000140000000-0x00000001401E3000-memory.dmp

          Filesize

          1.9MB

        • memory/1040-188-0x0000000140000000-0x00000001401E3000-memory.dmp

          Filesize

          1.9MB

        • memory/1112-199-0x0000000140000000-0x00000001401C3000-memory.dmp

          Filesize

          1.8MB

        • memory/1112-398-0x0000000140000000-0x00000001401C3000-memory.dmp

          Filesize

          1.8MB

        • memory/1424-439-0x0000000140000000-0x0000000140216000-memory.dmp

          Filesize

          2.1MB

        • memory/1424-250-0x0000000140000000-0x0000000140216000-memory.dmp

          Filesize

          2.1MB

        • memory/1556-174-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/1556-54-0x0000000000C90000-0x0000000000CF0000-memory.dmp

          Filesize

          384KB

        • memory/1556-53-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/1556-60-0x0000000000C90000-0x0000000000CF0000-memory.dmp

          Filesize

          384KB

        • memory/2156-332-0x0000000140000000-0x00000001401D7000-memory.dmp

          Filesize

          1.8MB

        • memory/2156-151-0x0000000140000000-0x00000001401D7000-memory.dmp

          Filesize

          1.8MB

        • memory/2156-274-0x0000000140000000-0x00000001401D7000-memory.dmp

          Filesize

          1.8MB

        • memory/2316-262-0x0000000140000000-0x00000001401A7000-memory.dmp

          Filesize

          1.7MB

        • memory/2316-448-0x0000000140000000-0x00000001401A7000-memory.dmp

          Filesize

          1.7MB

        • memory/3180-431-0x0000000140000000-0x00000001401FC000-memory.dmp

          Filesize

          2.0MB

        • memory/3180-238-0x0000000140000000-0x00000001401FC000-memory.dmp

          Filesize

          2.0MB

        • memory/3184-275-0x0000000140000000-0x0000000140179000-memory.dmp

          Filesize

          1.5MB

        • memory/3184-451-0x0000000140000000-0x0000000140179000-memory.dmp

          Filesize

          1.5MB

        • memory/3388-163-0x0000000140000000-0x0000000140177000-memory.dmp

          Filesize

          1.5MB

        • memory/3388-329-0x0000000140000000-0x0000000140177000-memory.dmp

          Filesize

          1.5MB

        • memory/3444-146-0x0000000140000000-0x0000000140176000-memory.dmp

          Filesize

          1.5MB

        • memory/3444-261-0x0000000140000000-0x0000000140176000-memory.dmp

          Filesize

          1.5MB

        • memory/3600-82-0x0000000001510000-0x0000000001570000-memory.dmp

          Filesize

          384KB

        • memory/3600-84-0x0000000140000000-0x00000001401AB000-memory.dmp

          Filesize

          1.7MB

        • memory/3600-86-0x0000000001510000-0x0000000001570000-memory.dmp

          Filesize

          384KB

        • memory/3600-88-0x0000000140000000-0x00000001401AB000-memory.dmp

          Filesize

          1.7MB

        • memory/3600-77-0x0000000001510000-0x0000000001570000-memory.dmp

          Filesize

          384KB

        • memory/3624-92-0x0000000000D50000-0x0000000000DB0000-memory.dmp

          Filesize

          384KB

        • memory/3624-91-0x0000000140000000-0x000000014019A000-memory.dmp

          Filesize

          1.6MB

        • memory/3624-210-0x0000000140000000-0x000000014019A000-memory.dmp

          Filesize

          1.6MB

        • memory/3632-226-0x0000000140000000-0x0000000140147000-memory.dmp

          Filesize

          1.3MB

        • memory/3632-417-0x0000000140000000-0x0000000140147000-memory.dmp

          Filesize

          1.3MB

        • memory/3812-349-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB

        • memory/3812-181-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB

        • memory/4164-70-0x0000000000890000-0x00000000008F0000-memory.dmp

          Filesize

          384KB

        • memory/4164-64-0x0000000000890000-0x00000000008F0000-memory.dmp

          Filesize

          384KB

        • memory/4164-72-0x0000000140000000-0x0000000140245000-memory.dmp

          Filesize

          2.3MB

        • memory/4164-187-0x0000000140000000-0x0000000140245000-memory.dmp

          Filesize

          2.3MB

        • memory/4256-137-0x0000000000400000-0x0000000000578000-memory.dmp

          Filesize

          1.5MB

        • memory/4256-249-0x0000000000400000-0x0000000000578000-memory.dmp

          Filesize

          1.5MB

        • memory/4324-103-0x0000000140000000-0x000000014018B000-memory.dmp

          Filesize

          1.5MB

        • memory/4324-19-0x00000000006C0000-0x0000000000720000-memory.dmp

          Filesize

          384KB

        • memory/4324-21-0x00000000006C0000-0x0000000000720000-memory.dmp

          Filesize

          384KB

        • memory/4324-12-0x0000000140000000-0x000000014018B000-memory.dmp

          Filesize

          1.5MB

        • memory/4324-13-0x00000000006C0000-0x0000000000720000-memory.dmp

          Filesize

          384KB

        • memory/4572-26-0x0000000140000000-0x000000014018A000-memory.dmp

          Filesize

          1.5MB

        • memory/4572-129-0x0000000140000000-0x000000014018A000-memory.dmp

          Filesize

          1.5MB

        • memory/4572-27-0x0000000000540000-0x00000000005A0000-memory.dmp

          Filesize

          384KB

        • memory/4572-35-0x0000000000540000-0x00000000005A0000-memory.dmp

          Filesize

          384KB

        • memory/4668-118-0x0000000140000000-0x000000014018C000-memory.dmp

          Filesize

          1.5MB

        • memory/4668-237-0x0000000140000000-0x000000014018C000-memory.dmp

          Filesize

          1.5MB

        • memory/4728-223-0x0000000140000000-0x00000001401C0000-memory.dmp

          Filesize

          1.8MB

        • memory/4728-211-0x0000000140000000-0x00000001401C0000-memory.dmp

          Filesize

          1.8MB

        • memory/4744-225-0x0000000140000000-0x00000001401B0000-memory.dmp

          Filesize

          1.7MB

        • memory/4744-112-0x0000000140000000-0x00000001401B0000-memory.dmp

          Filesize

          1.7MB

        • memory/5064-45-0x0000000000E90000-0x0000000000EF0000-memory.dmp

          Filesize

          384KB

        • memory/5064-39-0x0000000000E90000-0x0000000000EF0000-memory.dmp

          Filesize

          384KB

        • memory/5064-38-0x0000000140000000-0x0000000140135000-memory.dmp

          Filesize

          1.2MB

        • memory/5064-50-0x0000000140000000-0x0000000140135000-memory.dmp

          Filesize

          1.2MB

        • memory/5064-51-0x0000000000E90000-0x0000000000EF0000-memory.dmp

          Filesize

          384KB