Overview

overview

7

Static

static

3

2024-04-03...xz.exe

windows7-x64

7

2024-04-03...xz.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-04-03_ba05ca7e85cf2ca75c0bb8295a75a77a_magniber_revil_zxxz.exe
  • Size 24.3MB
  • Sample240403-xp5q3aac58
  • SHA256 e3c554113cc2c84642591ec5f0a245d0f25ffd596995495dfa299d67ffdf46f8
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-03_ba05ca7e85cf2ca75c0bb8295a75a77a_magniber_revil_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-03_ba05ca7e85cf2ca75c0bb8295a75a77a_magniber_revil_zxxz.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:216
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4024
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3988
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1132
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1232
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4220
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:316
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:400
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2928
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3960
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4588
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4536
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4224
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4568
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3520
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1628
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3368
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2404
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3336
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3904
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2596
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2548
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4592

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 b0d5a81bbad87db06037f676c114bfa775a6b37298cb7e2f3741cd86ae4fc994
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 2aef6edc35fab472341969927f6dedc1a8be448731f54fd47eb208c5dd96351f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.8MB
            • SHA256 caeeeff58058843777d00710ce6fdde96e048272cf958e645a62c52c17dc0413
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 c96f7f90c10357bf3deb311da98ec579d9ec71ce0444426105725954ba15c262
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 d715c217cd186a790f0c7445303685673ca583f1f61b1271927127f67092a920
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.3MB
            • SHA256 418361f395ee96574cf187bd6e597c6579a33519cc01db557a2c92cd3b35c339
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.5MB
            • SHA256 9ddc6c7e20012be29c7d2a23118673deb0563923caa1a7fd3012a9161f24c65f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 a5fb8bfc25c8582a4726d1741c6e5071b4a4c14fd86afe0b73e34a3ae6892304
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.6MB
            • SHA256 8d491fa297f77321abbaece327af51bff86fe20b1c702314968c78545a4a1c70
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 b1f7eec90822570316c822d495af5d5af68556ab2be1531462801fe4d0d993c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 0f6af8458d76edd8aae0fde624c5f5d9e2353da315367698d04879034e81fd85
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 7e0a89ae3be0ec1cf0fc96c1fec4bfe6a9bc5af48c7bd38e4cd3a4207f151741
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.5MB
            • SHA256 d7405579f278e2d877e2196eacf61b44b4fe741cc3f978edb06e0aabeee43b93
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 8abbd8500b1d3b54eeea1b254eebdd1e6e79e68a93ba17b501dafb38f9820471
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
            • Size 4.8MB
            • SHA256 389ccf79678d58d313d576de2c333c69e45d88c3383e8d46ec3831c0ce02fc58
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
            • Size 4.8MB
            • SHA256 51647aefab802f40073b8570f3b18e72b64b25b5e20d23a03d7cc0b8c2eadbc2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
            • Size 2.2MB
            • SHA256 2f56088af201581550e2816612aafe7ec19b604204be9dc121e32b0b36ab2975
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
            • Size 2.1MB
            • SHA256 39d06e71e8d6d236766ea048093c069c911639b9a74e1ca6242a81b90f15b3f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
            • Size 1.8MB
            • SHA256 be5ed532151e97cee1bebba7f63daa9ad5b90176bda8854ce0d69378445d65e9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.5MB
            • SHA256 3b5eaf41c220b860fc6b054893b3b1c7bde0e1e6cae12fc6014585c14a696c7f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.3MB
            • SHA256 d1728a2f2447d2b84e16166881f72fe16492fd718d6458591b62860ce2df93ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.3MB
            • SHA256 f25d683fb9d7af7efbec8b200576fca0ce4bcdad372b666713e5b6a8dd0c7a8e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.3MB
            • SHA256 abb31f8b4052b5d6979609309e936ede8566f34e896ddee3f280c74058c126a9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.3MB
            • SHA256 b15afd324dc2ff5990a2d480c1987156d87c4819bdde2172bb5827c487e75ad5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.3MB
            • SHA256 07ec989a97ee3b40aaeef7f4308075616c2017e26284803e258cc6727d14abbd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.3MB
            • SHA256 d5631f4500487acdc4747d4fd0f8f54e932ba6bc008b83363a65bc3696807f62
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.3MB
            • SHA256 4a40aa9ce61009fe950a80181087de591c3a1e314f416e8c13203aff8e3aafea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.5MB
            • SHA256 439b40a8ad0f1e0a2df403e925b91898ca1f6bec1af2c1544fa803566e5424a9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.3MB
            • SHA256 09c92e7ff50d91823e5c87eb58ae77fa15675dd3f29db07e3b3c24609eb46e85
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.3MB
            • SHA256 cf2cbdc2aa49d615f1adb21c8268516821451024e4ea43900233bf35ccba719b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.4MB
            • SHA256 358027a7be7f74ac47a50c3106ad9be025f5673cadad055182493a6f3357b0e3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.3MB
            • SHA256 ead95e48ec479084c1d7390cbd1c7c5d5d653c51befecd4668ae1fa1d0890843
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.3MB
            • SHA256 cd82eabd177379267b344e574c7d2b708779f306657c3c1c5fca29d073a04abd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.4MB
            • SHA256 24c61e34c64b71ea97985d84105fa141e5c4a8d397abb4b1f8c230cfdf2f2157
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 8c8f615f08ad2bc12efaa81a04975dff90402fa232c56af426b3e8eac1573fd4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.4MB
            • SHA256 c7f18c6dc8704f1b50c866f7bbaca00264ffaf8bbd6ccead8869318d45ed4b39
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.3MB
            • SHA256 b8bb5851b5d04cf272a8d14217fd61bee02a342d481fbc24a63d11b31cd31216
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 c77c803c580b62c83863864afe4832fd85290ad221a63ecb321afc2f707ccb78
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 4b4ee5361451a45d887988ae05730c3b34610b49723c5c83f92a3d89ac52719a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 09a343c8da1b719431d608131b5436d0bdfa630478118bbe7b57e1d89e6c1bb1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 64839e80c20b6818366184fe80813d7676560dd54183e6a2a2eed1d04820b2ea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.6MB
            • SHA256 ccaa8737b23c8aa071e1fdf9e7e24325e6721b6d5ca9c629591b4e904f641f0b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 f717d884f5f719f3de73d3254068606735fed8769cdba1ed5b5569869d74ed3c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 1d23b9389994453cfa729737f219ab055d4f65fb0a57870a145e612b7c0cc989
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 453582a16c1e38d210e71dcb2e631199d277eb1e9166782713d189c2ac0698fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 0d8c30b5766a218798ce8b99bd67884aaf6498747b1e8de5413e239d0b511caa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 f662ab8e7fbb5ecbd3afe1d63f609a6445eee88e008f4c11d525e570f02fad89
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 550226cfa8bdc6cc0fe22003cc59746735ea7c73f43e470871d9d70fe4988ddd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 711879a0fbeeb7d8b999c51d3d2e2f7366b98d85910a7b40057c1d557093c775
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.4MB
            • SHA256 b5a5b28b73ecabfa14162722741d029d387b8055929d5098e6e5eeb8c34f2b3a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.3MB
            • SHA256 4e73590e23b75d10a8842299fa07f4c6f90b6418d21bf85768638d9bb1280627
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 7b306a94d5d16fcba10fff00a7bd253dfd3f1356664580b04e38537ed02ea32d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 1e406b0a6218c39375e7503bec6f43ec03a90af9c9ef2757c2deda776bc909b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 6cfdb414537eb4244c7675122a45c843cd6650476bdc522797ed6ae1c3ce7054
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 21b1869a3cbab9844c462cfe01d260b793ed0faa720075f168d27b7ba4308124
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 367b0150e596327e0af80f7f96a21baac346bbb419a5d0749291f50256dae643
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.3MB
            • SHA256 ed224aaf2a32da426cdaa3d9c66cbde936707e1c14d8486c0b474e66f43dec0b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            office2016setup.exe
            • Path C:\odt\office2016setup.exe
            • Size 5.6MB
            • SHA256 88255f28a3e1bc400614bd372f6758d56c9d3e8926195ad1811c9211e16394b0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/216-0-0x00000000024B0000-0x0000000002517000-memory.dmp
            Download

            memory/216-7-0x00000000024B0000-0x0000000002517000-memory.dmp
            Download

            memory/216-6-0x00000000024B0000-0x0000000002517000-memory.dmp
            Download

            memory/216-66-0x0000000000400000-0x0000000001EFA000-memory.dmp
            Download

            memory/216-1-0x0000000000400000-0x0000000001EFA000-memory.dmp
            Download

            memory/316-72-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/316-68-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/316-135-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/316-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/400-92-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/400-88-0x00000000016D0000-0x0000000001730000-memory.dmp
            Download

            memory/400-85-0x00000000016D0000-0x0000000001730000-memory.dmp
            Download

            memory/400-77-0x00000000016D0000-0x0000000001730000-memory.dmp
            Download

            memory/400-79-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1232-45-0x0000000000EB0000-0x0000000000F10000-memory.dmp
            Download

            memory/1232-48-0x0000000000EB0000-0x0000000000F10000-memory.dmp
            Download

            memory/1232-51-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1232-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1232-39-0x0000000000EB0000-0x0000000000F10000-memory.dmp
            Download

            memory/1628-256-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1628-188-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1628-196-0x0000000000560000-0x00000000005C0000-memory.dmp
            Download

            memory/2524-296-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2524-305-0x0000000000880000-0x00000000008E0000-memory.dmp
            Download

            memory/2596-292-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/2596-284-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/2928-102-0x0000000000D00000-0x0000000000D60000-memory.dmp
            Download

            memory/2928-96-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/2928-94-0x0000000000D00000-0x0000000000D60000-memory.dmp
            Download

            memory/2928-159-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/3336-252-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/3336-244-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3336-446-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3368-269-0x0000000140000000-0x00000001401B1000-memory.dmp
            Download

            memory/3368-209-0x00000000008F0000-0x0000000000950000-memory.dmp
            Download

            memory/3368-201-0x0000000140000000-0x00000001401B1000-memory.dmp
            Download

            memory/3520-243-0x0000000140000000-0x0000000140145000-memory.dmp
            Download

            memory/3520-175-0x0000000140000000-0x0000000140145000-memory.dmp
            Download

            memory/3520-184-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/3904-266-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/3904-259-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3960-119-0x0000000000420000-0x0000000000480000-memory.dmp
            Download

            memory/3960-174-0x0000000140000000-0x000000014017E000-memory.dmp
            Download

            memory/3960-112-0x0000000140000000-0x000000014017E000-memory.dmp
            Download

            memory/3988-27-0x0000000140000000-0x0000000140158000-memory.dmp
            Download

            memory/3988-26-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/3988-33-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/3988-93-0x0000000140000000-0x0000000140158000-memory.dmp
            Download

            memory/3988-34-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4000-223-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/4000-282-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/4000-216-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/4024-76-0x0000000140000000-0x0000000140159000-memory.dmp
            Download

            memory/4024-20-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/4024-13-0x0000000140000000-0x0000000140159000-memory.dmp
            Download

            memory/4024-12-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/4064-272-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4064-279-0x0000000000C30000-0x0000000000C90000-memory.dmp
            Download

            memory/4220-122-0x0000000140000000-0x0000000140237000-memory.dmp
            Download

            memory/4220-53-0x0000000140000000-0x0000000140237000-memory.dmp
            Download

            memory/4220-52-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/4220-59-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/4224-214-0x0000000140000000-0x0000000140144000-memory.dmp
            Download

            memory/4224-149-0x0000000140000000-0x0000000140144000-memory.dmp
            Download

            memory/4224-155-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4536-137-0x0000000000400000-0x0000000000546000-memory.dmp
            Download

            memory/4536-199-0x0000000000400000-0x0000000000546000-memory.dmp
            Download

            memory/4536-143-0x0000000000860000-0x00000000008C7000-memory.dmp
            Download

            memory/4568-226-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4568-161-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4568-168-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/4588-187-0x0000000140000000-0x000000014015A000-memory.dmp
            Download

            memory/4588-125-0x0000000140000000-0x000000014015A000-memory.dmp
            Download

            memory/4588-132-0x0000000000B40000-0x0000000000BA0000-memory.dmp
            Download

            memory/4592-230-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4592-235-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/4592-240-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4592-241-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download