Overview

overview

10

Static

static

10

2024-05-09...xz.exe

windows7-x64

7

2024-05-09...xz.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 22:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-09_917936fec53cf86697afb10f74128d87_magniber_revil_zxxz.exe
  • Size 24.3MB
  • Sample240509-2t9m2aef55
  • SHA256 5b1c3d41c1b5301507b30120828d71b35988e45622554e4bedac4c1ff1a00e8f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
privateloaderloaderspywarestealer

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-09_917936fec53cf86697afb10f74128d87_magniber_revil_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-09_917936fec53cf86697afb10f74128d87_magniber_revil_zxxz.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1392
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4672
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4220
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3100
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:856
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2916
    • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4584
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3200
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1200
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2392
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4844
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2464
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
      1⤵
        PID:5040
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2336
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:2156
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1952
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:584
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3356
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:2280
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4008
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:2112
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4372
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3308
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:4980
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5148
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:5540
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:5568

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
              • Size 2.3MB
              • SHA256 f10afdd9a332996c33337c6a64f5ad79c5e8c9bd15aa5cc067582b39000f7254
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.7MB
              • SHA256 1be1005ff489b090c94922403b1ea0caf2d27534f79942c9fa2a990e5bc4a06b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 2.0MB
              • SHA256 b6a51676c68eb799dd3d21b620dcf39f464ca44e724bb4a3e7f7c25b7f4727e5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 fb71e124ba796e78d5ccba3c916f2002a0afff29c42ac4a19c4a4ff00f3c3b9d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 8a5801f6dc6a305a070ba2ce2a977f8241dbee2a29c9b93ff6eca5ed23c5bbca
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.4MB
              • SHA256 ef022f9988a2cde3cc2d5fe19fed4dbe5359d8f753687f247dd82dee7e25e948
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.7MB
              • SHA256 4abc2873aedf880837b1e098f2aa52231a3b81236eb536d8fc0c352ff6200691
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 a9c0e5644c7d1e7daca28e740c3efcef131bc39c29e67aae29706f6c1de5b50c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.8MB
              • SHA256 905b2e14a2834da0f806e29f341d0886ce2300e6e6f7c1785c3022f91e959300
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 d193758667739591b58b16eeab6b49f28b8b6320448d8465ec22af91a9b4273c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 228864bd1ffb80734dfac4e6848730df62d008463dd3285ff1d63fddc8925fbf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 a580ea6d4cabb7d39279a0fc5424e3893d3f6433466f9047048db4b0f2b92656
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.7MB
              • SHA256 b120cb3f1e6771402022579457817f4517ec1065e76099595bee58bdfb0cb808
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.5MB
              • SHA256 2462397db1938566c5e34764fcdf7aa16f0a6d6b90a0e2d8c794e014627b26e8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
              • Size 5.4MB
              • SHA256 edf697b8dc60da609f822a219a2116de9a7dc157fe388fd3df4e6ba10e9e42c7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
              • Size 5.4MB
              • SHA256 d38a662a04c27a7b12390e9f545a4f57ce1dc8b8a490bcf5c999547db4409005
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
              • Size 2.0MB
              • SHA256 e73d9b501deb4d5bd3cf8c33f11b20a8a7685addb9d2f91947c7754c808da8d5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
              • Size 2.2MB
              • SHA256 a452c918cd7918bd1b9b1e2e6fac82275ff2c52af9cea71d60782ab17561fe52
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
              • Size 1.8MB
              • SHA256 d123cbce7ef5e509fdb656cb1cb9ce1557864b9f1ad13e3574faf0d5740bb965
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.7MB
              • SHA256 93a1395e37fc92f8bb4349a26624f439cb069a08f4be0f425468037fa189f086
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.4MB
              • SHA256 d9de1cd4e65b50640ae0241d4c8af8e251164c7ffd73834f9b46f4123200b7cb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.4MB
              • SHA256 b70fb8cb8caeb7080e9316be26f2417e5d692bad18d75447ea970928aa4426e5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.4MB
              • SHA256 b72a33f449118bafd5305f82331f3dacba881118d1a88c3d108b68024f80e5ae
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.5MB
              • SHA256 7eb576960602d24a115f78615b9d7f38f5720270429971db5ff765fc21f0b93f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.4MB
              • SHA256 58124d60e6e1c4e01917c587896a67a6f60aa610166dfe1db6982169ab0a1c04
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.4MB
              • SHA256 adcf7ef7f13582dfa00a60fd551ea195dba7f4cb1638997960fd29ac2f0c0a36
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.4MB
              • SHA256 3127d585c75eb2aaaf90358ccf40ca40277b58a5ab456b002479f300d41149d3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.7MB
              • SHA256 03816af3ecedc508f0c8310182646fdfc092319f95ea6fac516b63f611d5b9c2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.4MB
              • SHA256 90874f4cb1dfe1a37c1edfa8586df5d01b08278b183217c85c34d8ea4e5bf6c8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.4MB
              • SHA256 0860b9789ccc17545afe6dcb3cf463fa9fdd00d526b138ada083e2f23a786ad9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.6MB
              • SHA256 8a054eea6d7f87e13d402b5078e8b17d993558d6d05899bf7cf0289d1c67c983
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.4MB
              • SHA256 e8ccaa290f91f5a792a4d45de48254b2807a044a1239f75f4289cf36c49d9716
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.4MB
              • SHA256 f83a0fd106095892c468a25408e1051d24059978b9c3a84ba3fcb27083d2a8a0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.6MB
              • SHA256 f330717ebfffa39e2406a57624fbeccb163e56147964dd36d8a2228bb8047614
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.7MB
              • SHA256 52bc35b59b3a53b66353b9da581ccc2eb922cf39b6c7b909facbd23b753f62f2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 783dda7159d5ddeabf08d297cb4888f136b95c899ec3bb649a225fa21fc50375
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.6MB
              • SHA256 27ff024b241f3a5a38a924c41f69de13237e8a06df619dd962043dee68e58f05
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.5MB
              • SHA256 260b62b407a237a5ea985d4b857a13e53621e8cbc9d809dbaa9e59a83283da80
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 8b8a51140885d6b8c61a33dee5fa14f3821e2ad06098fd46e58c12463bbbf84c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.5MB
              • SHA256 456a363b1d10b6d2752828cd91c5b1ebe1bdfe335a2eb69e017fbb1fe980b38b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 61db8a35fea62d0b1cb0754e6d8c7b62c91f2092d00beb40377a113676563515
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.4MB
              • SHA256 890d530f2d2f7b21d8624edded72217e7f2b49de06c7377dc7f2f181e098bb00
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.8MB
              • SHA256 49598cb8b1ea31a92410507e79d4b95a74ee65064d6f7d321304b6d1353e883d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.5MB
              • SHA256 a8bb73c5a486e99fdba6ba6318fe961503d9daa904e02be4fa08c3e0b064fe69
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 f1fa59611cd1f84dc4d909d273f61bfc6c116ce299fc755ae92435eb5010bc6f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 ed7d128559f6f8bb7bf416aef391e070f20ce1e9e6cc4e52698fd2f13dc022d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 c8e02a82f02a0657307a52c500dbac9471cf7de38242841695adfb437c5b882d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.7MB
              • SHA256 108d23a254dbf033c245e9b5f320259d91d7f14508851edc25cac014e304ef8c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 9499a34cf423f4ded7d7d1bc23a04c37fe24c3881b6f598aa434f647594e16f6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.5MB
              • SHA256 1b4a6c46cf1b56953c065d4751fb5eb2687d2038b36b8fd06f9b09275ca2f7a9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.6MB
              • SHA256 4bb36c745fc3eda0ef65421183d9b56869dbcfc0c3615e2952e23f354c6c4ebf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.4MB
              • SHA256 5fc7e5b0dec1d56c5aa230ca7e4ffef380529932bd6d0e470c6839ecd5e61b55
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 e7112853d08a40d256625e99bb80936d8352df54a89190dbc4229e0f3038755d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 1.6MB
              • SHA256 efbdbc154f4dcd7260acc17e2fe07b4c9d956e056a7188bca71a08c1baa2bc54
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 acde9e34566b3f8d2905bacb6ba5f299a72a7cd6ceadb68b15c8c67918f45c6c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 08c095386cf2f783f9c203c1e3076df995207b625f26e09aa6f84370c4a306c6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.7MB
              • SHA256 dfa8215c19661f12227fd330755ecc92c9ab547605eb22d0cb6ff5bba5bebff0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.5MB
              • SHA256 227174436f1a41bfc12447d0c93b88d3ba463368de6d48dbd2c6c02f8b4892e8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/584-504-0x0000000140000000-0x00000001401E3000-memory.dmp
              Download

              memory/584-180-0x0000000140000000-0x00000001401E3000-memory.dmp
              Download

              memory/856-39-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/856-33-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/856-46-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/856-44-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/1200-93-0x0000000140000000-0x000000014019A000-memory.dmp
              Download

              memory/1200-85-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/1392-30-0x0000000000400000-0x0000000001EFA000-memory.dmp
              Download

              memory/1392-66-0x0000000000400000-0x0000000001EFA000-memory.dmp
              Download

              memory/1392-5-0x0000000003C30000-0x0000000003C97000-memory.dmp
              Download

              memory/1392-0-0x0000000003C30000-0x0000000003C97000-memory.dmp
              Download

              memory/1952-175-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/1952-467-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2112-223-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/2112-591-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/2156-164-0x0000000140000000-0x0000000140177000-memory.dmp
              Download

              memory/2280-589-0x0000000140000000-0x00000001401C3000-memory.dmp
              Download

              memory/2280-191-0x0000000140000000-0x00000001401C3000-memory.dmp
              Download

              memory/2336-162-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/2336-502-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/2336-265-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/2392-100-0x0000000140000000-0x00000001401B0000-memory.dmp
              Download

              memory/2392-216-0x0000000140000000-0x00000001401B0000-memory.dmp
              Download

              memory/2464-240-0x0000000000400000-0x0000000000578000-memory.dmp
              Download

              memory/2464-129-0x0000000000400000-0x0000000000578000-memory.dmp
              Download

              memory/2916-48-0x0000000000720000-0x0000000000780000-memory.dmp
              Download

              memory/2916-54-0x0000000000720000-0x0000000000780000-memory.dmp
              Download

              memory/2916-70-0x0000000140000000-0x000000014024B000-memory.dmp
              Download

              memory/3200-77-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/3200-71-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/3200-80-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/3200-179-0x0000000140000000-0x00000001401B0000-memory.dmp
              Download

              memory/3200-82-0x0000000140000000-0x00000001401B0000-memory.dmp
              Download

              memory/3308-241-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/3308-593-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/3364-140-0x0000000140000000-0x0000000140176000-memory.dmp
              Download

              memory/3364-252-0x0000000140000000-0x0000000140176000-memory.dmp
              Download

              memory/4008-214-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/4008-210-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/4220-28-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/4220-22-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/4220-43-0x0000000140000000-0x000000014018A000-memory.dmp
              Download

              memory/4372-592-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/4372-229-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/4584-174-0x0000000140000000-0x0000000140267000-memory.dmp
              Download

              memory/4584-68-0x0000000140000000-0x0000000140267000-memory.dmp
              Download

              memory/4584-64-0x0000000000990000-0x00000000009F0000-memory.dmp
              Download

              memory/4584-58-0x0000000000990000-0x00000000009F0000-memory.dmp
              Download

              memory/4672-41-0x0000000140000000-0x000000014018B000-memory.dmp
              Download

              memory/4672-16-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/4672-10-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/4844-111-0x0000000140000000-0x000000014018C000-memory.dmp
              Download

              memory/4844-228-0x0000000140000000-0x000000014018C000-memory.dmp
              Download

              memory/4980-261-0x0000000140000000-0x00000001401A7000-memory.dmp
              Download

              memory/4980-597-0x0000000140000000-0x00000001401A7000-memory.dmp
              Download

              memory/5148-266-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/5148-598-0x0000000140000000-0x0000000140179000-memory.dmp
              Download