Overview

overview

7

Static

static

3

2024-05-26...xz.exe

windows7-x64

7

2024-05-26...xz.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_579055f6a11b236ce9d0249dc13d336e_magniber_revil_zxxz.exe
  • Size 24.3MB
  • Sample240526-ec4dcsdg7w
  • SHA256 29972d385d0ba872110b0d1f8a38b0376b30e7b46eda5878624e524360242c94
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_579055f6a11b236ce9d0249dc13d336e_magniber_revil_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_579055f6a11b236ce9d0249dc13d336e_magniber_revil_zxxz.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1596
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4108
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3704
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4988
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1628
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1620
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:720
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3580
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1932
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2352
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4272
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1268
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1832
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:636
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3852
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2992
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:872
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2240
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1444
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3824
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1960
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:720
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5196
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:5248
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:5384

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
              • Size 2.2MB
              • SHA256 b114e56b3a344c509488d38662c733f71ff34593ff8dfe3db9cd1316efb4a125
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.5MB
              • SHA256 108f164a35e23ea08d691d520cf17603ac610570240114a563c74a148a8cb3a2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.8MB
              • SHA256 1e63fc887f16b73349db22afca11db092db5a41b80ac6234c76e12d843058d40
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 9fca9de1e9f47b70c2c6d3b19cfa2ef532003d979b1ab224814144a414345118
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 428d13982ff236e610f2cf9e9a369889e49fe381ef066cd4d18823b9776b42b6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.3MB
              • SHA256 ea276120c8d445cbe73c903ff9b15e436596d46ceaaece5bba8e7c3f2ed2f425
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.6MB
              • SHA256 f39b032f7ba545dc82387244549ea961141436897cf739fdf89c3860372bfb56
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 f50f3a48c7c43ac78c88d2e680aba7da9848a22f12589397043f498820e3eb59
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.6MB
              • SHA256 b03e4acde757939bbdc41e0911f91d656c05b04677c92bd7be5f1f5bc07dc02e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 d445b3d9c5751246fd5bf3b6fae72b62083007261ea0c5dc66dfcf398dd5c39c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 527d28bff667d138b57cf3332011cbdf1dd96517f93776010762cf6f1d3e4c05
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 2349708f1fdf1c301e040ba2cfad0f056ba5531c0b3de3e9c98a28ae6cc8cfd6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.5MB
              • SHA256 1935ad629a6dc8cbfd38415d342be972782a7e26613280dc8eb1e034553d5e38
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.4MB
              • SHA256 1d9ec82071df1528e8d90fcc2388d57f9f0cfc85a123102e8c84b1e84f9a5678
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
              • Size 4.8MB
              • SHA256 bfec4dc93fe1954362ff2223dab0a832d4670b1fa8a0f1c8ed566c3eb94f5974
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
              • Size 4.8MB
              • SHA256 6455a482d65c2cdcd4529bc42113e32e76d88ab443ba31c01259a625ef9ecb8e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
              • Size 2.2MB
              • SHA256 c425b4c696c23b5e1f405c65a971ca583caf67b244e5c4aef7756dc8a1c3129c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
              • Size 2.1MB
              • SHA256 ddb770eaa50857777c71d8086f24ec3abad9c59b9f43bb64ff7ceea24a01e46c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
              • Size 1.8MB
              • SHA256 40ac5f157403c25fc781bb94c0558c211ca3b3a30b0168de42b09a0297f279d2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.5MB
              • SHA256 4b544343b910f88aec5e21a657cd6a787e238d12917f0f45315a40a14c91065c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.3MB
              • SHA256 327ab64c09a4f3a0a73eed2938b96ac4bf45d83aeca67a1e488e3716af2de02f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.3MB
              • SHA256 43f271f9fd956922cd899a27242a7f9f85d3c31b04c4e66807c21a066f6ab57b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.3MB
              • SHA256 4f5a519daf89ce1c8dd08458c693a79a5701e099f494ed24e43fc9eff84e0fe0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.3MB
              • SHA256 e747752cf4babb40e38820f118b9e4105b6e8d0b7239616018105ebbbac8a516
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.3MB
              • SHA256 74d931b66ff747a07972a20f34ce7b0d1a82e097a0ccc9300f5e2aafc8191427
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.3MB
              • SHA256 b1300617cdb37816a6260fb4751b963b53f74f6432759376f6c0efa4dd740f1a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.3MB
              • SHA256 c1fd5571a29b439fbd1b300a9cd7fdc19bdb5c854dab53da8ffd0cf0fefd3265
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.6MB
              • SHA256 b6aedd116bd9a12d1d6f617fafb4b0d4c196297545d4b319a27d36d27800950f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.3MB
              • SHA256 be188a82a9caf2b949d17d72e9d66f2651f8ec123ff142e22aeedc9affb45926
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.3MB
              • SHA256 5a4a38d1ff9357a9d1d07ead82657263eddee3a9424eb153b5aae27b666dd120
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.4MB
              • SHA256 aac772ed66263bbb64946599734c72899f0375256909bad081c0825c873814b7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.3MB
              • SHA256 4626457a653caa6c813a0190d2944a7aba6b604670c2e0ab518ee979e22fda3d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.3MB
              • SHA256 7f2375bf3eeae19ae27249f0bba0065a759245cb514475f36d805df5f084e0d5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.4MB
              • SHA256 303544ef29c3693e4a2759267781adbeb608dc7991db7ebb8dde58320d3aa895
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 8f64f060375b64f40f765d49de6ab5a6874ea6bc4eb9638d8d25d90be63c9a82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.4MB
              • SHA256 28a38f471144efcfbe98c0f72d60164b9e3da6caf6ef75549f4970057c4a32a0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.3MB
              • SHA256 65cd5ca0490afef97e753aef6ecff84b891fc2413719685a8a3cb911bee2a3d2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 072e0da74a629da72d9e0392ffee5034e0f06300d4f84227774927a3e684256d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.4MB
              • SHA256 745d123cfc83501ba126cdadd06364c9d85921e14259346b559ba6115ea18b78
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 ce55a2669ea26d8797499ca4ec891aa4b805a1f181d9160bde36ff17c0c222e4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.3MB
              • SHA256 f7ee97fd98bc3edb2268c98bf7036f5506474b37347c7125caa72d66fc166541
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 b9a67b5cb604f90e21beefd9734e498dc05b027358a631691ba74123ad2f6d13
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 0f8e271e9c9fba54373879eddd66471660a146b8a6b37d5f6f28e3b4d0aae645
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 96f2c4960b1bca919ab66b8e214fb474f9907ba01dcbbdb3eae8d0974c72b16a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 e669a780cb479ba8b227f95265bc0608b1122c4613098b7531e1d06c44a68440
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 42e01b5850db2a4b1a43f50f2860cbda39eb014845a75cfbe59f9744ab5b1db9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.6MB
              • SHA256 217799d9c390b5d001ddb2a32b61aa1b2d69b05f9df266492e9bad7e475ee4f4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 38941178d1e198f46ecdef795a22773b50842875a59fc75dd201ee16f2869c6a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.4MB
              • SHA256 bcc4c778a442f770f72258923892c11144b8a457bdbd4a537daaadd472b11a9d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.4MB
              • SHA256 a4879f443604a5f92e486e113e559424b2e0c7c02600eddcd0c963ba119d5eee
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.3MB
              • SHA256 46551757e2666427b426f32bed33e312b9a0ebec3c666e0e41e28a900de14384
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 36817391bf49247836420426793943a2db8bab26d900bf3c3c30043db2f68750
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 1.5MB
              • SHA256 259ff58c806eb6a9df5a8326d7fd78215fa83501120c59e61d51d28b1b19fd8f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 41741c7926ff86ad44f6c9812c1f88826e212eb3fae0716be5ddeea8e11400a7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 3b2ac0a5773d5a073ce6b92718490e3430ee1eba52cf5447f24cc917defee0c2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 23d3f58b7d2a01ba00da665223945c8dcd95a545eb46d3b885a6432343863b6e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.4MB
              • SHA256 36a74e0ae83f0bf3491015a8f1050d4edcb8eaacb9b51f406d53d65238742b88
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              office2016setup.exe
              • Path C:\odt\office2016setup.exe
              • Size 5.6MB
              • SHA256 637063de8e077319c904146d9eeaa119c662176e20c92e113df078696e05df3c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/636-323-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/636-166-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/720-81-0x0000000001AC0000-0x0000000001B20000-memory.dmp
              Download

              memory/720-72-0x0000000001AC0000-0x0000000001B20000-memory.dmp
              Download

              memory/720-476-0x0000000140000000-0x0000000140185000-memory.dmp
              Download

              memory/720-78-0x0000000001AC0000-0x0000000001B20000-memory.dmp
              Download

              memory/720-83-0x0000000140000000-0x0000000140189000-memory.dmp
              Download

              memory/720-264-0x0000000140000000-0x0000000140185000-memory.dmp
              Download

              memory/1268-143-0x0000000140000000-0x0000000140154000-memory.dmp
              Download

              memory/1268-255-0x0000000140000000-0x0000000140154000-memory.dmp
              Download

              memory/1444-438-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1444-220-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1596-0-0x0000000000400000-0x0000000001EFA000-memory.dmp
              Download

              memory/1596-6-0x0000000002590000-0x00000000025F7000-memory.dmp
              Download

              memory/1596-7-0x0000000002590000-0x00000000025F7000-memory.dmp
              Download

              memory/1596-1-0x0000000002590000-0x00000000025F7000-memory.dmp
              Download

              memory/1596-94-0x0000000000400000-0x0000000001EFA000-memory.dmp
              Download

              memory/1620-69-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/1620-67-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/1620-61-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/1620-182-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/1628-50-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/1628-58-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/1628-57-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/1628-169-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/1832-327-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1832-273-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1832-146-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1932-219-0x0000000140000000-0x000000014018F000-memory.dmp
              Download

              memory/1932-111-0x0000000140000000-0x000000014018F000-memory.dmp
              Download

              memory/1960-456-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1960-244-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/2240-217-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/2240-205-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/2352-114-0x0000000140000000-0x000000014016A000-memory.dmp
              Download

              memory/2352-231-0x0000000140000000-0x000000014016A000-memory.dmp
              Download

              memory/2672-194-0x0000000140000000-0x00000001401A1000-memory.dmp
              Download

              memory/2672-386-0x0000000140000000-0x00000001401A1000-memory.dmp
              Download

              memory/2992-191-0x0000000140000000-0x00000001401C1000-memory.dmp
              Download

              memory/2992-351-0x0000000140000000-0x00000001401C1000-memory.dmp
              Download

              memory/3248-277-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/3248-477-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/3580-86-0x0000000000D90000-0x0000000000DF0000-memory.dmp
              Download

              memory/3580-96-0x0000000140000000-0x0000000140178000-memory.dmp
              Download

              memory/3704-33-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/3704-31-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3704-25-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3824-232-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3824-446-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3852-329-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3852-170-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4108-18-0x0000000000710000-0x0000000000770000-memory.dmp
              Download

              memory/4108-13-0x0000000000710000-0x0000000000770000-memory.dmp
              Download

              memory/4108-20-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4108-108-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4272-125-0x0000000000400000-0x0000000000556000-memory.dmp
              Download

              memory/4272-243-0x0000000000400000-0x0000000000556000-memory.dmp
              Download

              memory/4504-42-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/4504-43-0x0000000000460000-0x00000000004C0000-memory.dmp
              Download

              memory/4504-36-0x0000000000460000-0x00000000004C0000-memory.dmp
              Download

              memory/4504-45-0x0000000000460000-0x00000000004C0000-memory.dmp
              Download

              memory/4504-47-0x0000000140000000-0x0000000140135000-memory.dmp
              Download