Overview

overview

7

Static

static

3

2024-05-30...xz.exe

windows7-x64

7

2024-05-30...xz.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 14:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-30_4f80ec4b9f735bef31d8f23cbf1992dd_magniber_revil_zxxz.exe
  • Size 24.3MB
  • Sample240530-rehkwsbb21
  • SHA256 3f275b01f6c14d8383312820c4c6d6f37e05943436d446c69d0a8aa3f36a8ade
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_4f80ec4b9f735bef31d8f23cbf1992dd_magniber_revil_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_4f80ec4b9f735bef31d8f23cbf1992dd_magniber_revil_zxxz.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:232
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3048
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3080
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1200
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3680
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5004
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3896
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:392
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4820
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4576
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3492
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3208
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:988
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3940
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2332
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3180
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4552
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2244
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:832
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2232
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1376
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:832
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4648

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 e3a79e046c68fd370af3caed8405bf8668a88d50a7d9ff06fc024acdd7d3293b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 1921c53d6131c03b3bb78122baa9ff2c69824416fa00dda6d70b43fb277338c0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 e9711766be552e64f835ae9dbe6b936c22a0e1e18b35e6ddb3b898b92769c35c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 334fc638ba01f3951e11b39b4bb1e754ffcd05985caddbb8153fd052aafc39d7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 c4cb2f5cab41bf99499993378fed7c05302300319b0e9bd72a2c35bb2d17b63c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 ad0da2f98a6dbb69bb77d0bd433bf6ecfede14934088348d5a535925477ade06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 7ea5e158922e4691e189c1c09c6074d8ef000b158d6e827ad311be595e299736
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 24751acd8b005cbf0a9050c19e547673513aca90e9d6297335417eb6d29efd26
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 48c8b685f7532b1c4f15f58e038c5385598fb95f00e0aec8967e494fe46e8cef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 20f5b52e7b5d4dfe4143e403a11d1c44802d67a4a882bd062880490cb6cea3cb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 e18637acb5441f70a7ae9e34c0239163b140aae5e8f76e9f0cd4f187b787ecb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 6764d80a92b3cdac84a3793b1e02647b551bd539f62e45314222c507ad1ac678
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 e2fed07b88bc9247b799bb7691de1a1cba2880e347a974eeceb49cd791aefa68
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 bfdf6d2376f8c6174c21bc007cdacd6c55bf16b44d34910615739e9eea392ed0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 fe2f99bdd7c91ed9ef8c771ef961624f873ce999237b613e609603d20e23c0cf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 51840b8d63a0080e1dc36c3f76cc2a0f559f833b6e3222ded433ee185fdc89df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 ecd4b0a20c35c178c65443fca3c85cf56271a8f68c284830a57b6567f2750948
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 d858e031540f8248121eda67b2218301a1ab8e8b7e9d99d492a27e75c2a29e1c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 5d20a61e7c481d993979e0768c561fb64432b2f0d51d1b8e12a5e5a935a70d42
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 61997766817d0cfa633a8f27519b2d3807f19e38805cc74f2ae5dff1a6e1fc5e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 b9e13ba1b09e1f6b728efe356e5c4e8b9994e542fd78035ce0a61c148e07d3ed
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 acd5af727a69bf4521875b75eac2a8bc6b29d4fd1af688cd9a6bce61e1f2f90c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 424564d9b48c5025a9a825c97ebe78874d6d3138146a708f96d1e293f0a1f617
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 8611b86892d776c27f25e59a34375ed6fa074de966504bb8fc27b967ec4ad186
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 e37caf072bd6cdb32b7314626214f9ef9ebc239a7529f3560d7b572efabfd10e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 af9c708a0b2a49e933bc9ed78528c19d7c5e63985b6b8209eae2f8d94eb0a0f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 557fe0465f2950ff1fb01f5acfc18d86757f7630ea5cdd745e4f3d92cd1fb14b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 22e902c0666ad7e8eb960f44a2bfb48121da98efa40b5b083940e4366cc1a5f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 cde3b775a9edda4351a45e23ad59121fa088068ed9239ef70644d50b4fce772b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 06e251da2fabf67f37ba7be37bd0b72b230e566882b3985cb4fcd662c6eb0068
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 e6950b0296d542e34b960f3c4c96faceb88b01933a963696788edc957ea81ac8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 3a751c41443faf3dbc9035d05f984343aface8739a10666a0d2451dd267d479c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 dda1a818173fd4e86c2ba3bf1b7e35c454bc3c505c54b60a402b7de49e391746
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 5b65820d50f3306b53b6103c61b43899c522b08a2ba420a4f000f49ed779f2ff
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 a1505cd430f4c25090b5e86fd1fbeaaa19f5ac414653540b8225975ceb977cfc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 e134bf0e13c3dddbde5b0ac66e10b9e090f56383b29a1644e8071bab5e21c626
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 88494f1d78fde106e102d9ff57fda923cf413d8167d23806e69fd2d6cea9eeee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 f75de9b3d666e3c052b2ec06892f5367b1f5156148f6794194518208122fba89
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 81c99e2b0a6caeff19092950ed4354c5ea29e6cfe2648d03e0d4104d4835964f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 432f55b441e9b9ca3e5934b61b10ec9c8d8354af043d19f77848b7baeee51b06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 7216dcc9d1d4ec450cd836fa5c1d5e9bf85415ab1c3a665b3fe6328f7ac9207f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 ec5116bd6c14fa8a1be963a4f576744e15a02e424efe195f7cdc304f391a0ccf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 cb1eab4bad0277dbf9be36c46fe7c6a7ce7c670b5a4fe93c9ed79db8925dee44
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 4c31352b03c474b167d5466fa786c33995ca2a6de1274c1c1da24815ee2c2198
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 d539a4b44fd0aec8343263547bcbe8205443a69dba004ec5c02564b103c41536
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 590461e861764da1358cbbe13f2512ee477d97d23bb0bca078c9a51eeaf0b4e0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 edadbd0f81f38646a5fba43d058082001175b94d8cf8f62cd79cf53283f66a59
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 f23b9e23bcda1133c6d416dbc024b4aa7f8f729f0f7b7f3b1c86c84a9db67c5b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 9f3e23f4af4345c538216967060cea290ba37fe147035a808ad39da1c9e6d03a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 65e9e6ba6c301a7907f6997a365edccd712ec7ae04af35754f515a79259a36fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 bbc899be4f772ccad7eacc51d7a81040e8829b943d86fafa36ff06b1d31bdff8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 3929e6afd41bf19f2a43b7fdc7820980d4038ae426f21b1e435b93a32f9e3dd4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 301c78aad7a589fd6a3103b1bcfda138a7ecf159daf4a1eb662df2a460080e9f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 2ae5db46b2c1e9a65b67acf0fe4a77f0b518b4a7743b5a712e8f0fa251433535
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 336ba33b46c09627704e97c9da69cf05634bf72f3dcc3f8ef08f8a011c3bdcf7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 bb77cfa84ee12324215e12082b830c2efc33f3a868484eda583b17cd39225d9f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 1e3bf0c7281cf7c21545414753777f9ae2eb285cae7d21094a41268c59f71e19
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 f9ef2f3bef66d1283322fcc136f5207f59982941cbb3e0834c62850cd9a0d2e0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/232-9-0x0000000000400000-0x0000000001EFA000-memory.dmp
            Download

            memory/232-0-0x0000000002170000-0x00000000021D6000-memory.dmp
            Download

            memory/232-112-0x0000000000400000-0x0000000001EFA000-memory.dmp
            Download

            memory/232-5-0x0000000002170000-0x00000000021D6000-memory.dmp
            Download

            memory/392-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/392-215-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/392-87-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/832-219-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/832-216-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/988-156-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/988-475-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1004-44-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1004-59-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1004-42-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/1004-36-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/1004-56-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/1376-277-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/1376-515-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/2232-275-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2244-512-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2244-204-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2332-510-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2332-180-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3048-19-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/3048-113-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/3048-17-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/3048-11-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/3080-33-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3080-144-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/3080-25-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3080-24-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/3084-516-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3084-278-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3180-185-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/3180-511-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/3208-145-0x0000000140000000-0x000000014012C000-memory.dmp
            Download

            memory/3208-471-0x0000000140000000-0x000000014012C000-memory.dmp
            Download

            memory/3492-134-0x0000000000400000-0x000000000052E000-memory.dmp
            Download

            memory/3492-446-0x0000000000400000-0x000000000052E000-memory.dmp
            Download

            memory/3680-48-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3680-178-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3680-47-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3680-54-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3896-72-0x0000000001D10000-0x0000000001D70000-memory.dmp
            Download

            memory/3896-84-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/3896-82-0x0000000001D10000-0x0000000001D70000-memory.dmp
            Download

            memory/3896-78-0x0000000001D10000-0x0000000001D70000-memory.dmp
            Download

            memory/3896-80-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/3908-312-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3940-160-0x0000000140000000-0x000000014012D000-memory.dmp
            Download

            memory/3940-509-0x0000000140000000-0x000000014012D000-memory.dmp
            Download

            memory/4576-115-0x0000000140000000-0x0000000140142000-memory.dmp
            Download

            memory/4576-311-0x0000000140000000-0x0000000140142000-memory.dmp
            Download

            memory/4796-276-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4820-114-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/5004-184-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5004-67-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5004-69-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5004-61-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download