winexesvc.exe

Classification: Malicious

winexesvc.exe is a potentially unwanted program (Windows 64-bit executable, 28.0 KB). Flagged by 34% of antivirus engines (70 detections).

Detection summary

  • 70 antivirus detections (34% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: WINEXE (S0191)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Win64.Winexe Hybrid-Analysis 2019-03-22 20:15:04 2019-03-22 20:15:04 S0191 Winexe

Tags

apt apt28 fancybear group-4127 group74 irontwilight pawnstorm sednit sofacy strontium swallowtail tag_0700 tg-4127 tsarteam

Sample information

Filenames
winexesvc.exe
File type
PE32+ executable (console) x86-64 (stripped to ext ...
Size
28672 bytes
MD5
1fd9ccecac8794f39d826fdd8a62e6bc
SHA-1
76e6864d8f35530b8d8573b3cebb7921222788dc
SHA-256
ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694
First indexed
2019-03-22 20:15:04
Last updated
2026-10-14 06:38:38

Antivirus detections

EngineDetection
CAT-QuickHealTrojan.IGENERIC
CylanceUnsafe
Invinceaheuristic
ESET-NOD32a variant of Win64/Winexe.B potentially unsafe
Kasperskynot-a-virus:HEUR:RiskTool.Win64.WinExec.gen
RisingPUA.Presenoker!8.F608 (CLOUD)
ComodoApplicUnwnt@#i25marlrzmxz
VIPRETrojan.Win32.Generic!BT
FortinetRiskware/WinExec
IkarusPUA.Winexe
CyrenW64/Trojan.ETXK-2034
JiangminRiskTool.Winexe.g
WebrootPUA.Gen
Antiy-AVLRiskWare[RiskTool]/Win64.Winexe
ViRobotAdware.Winexec.28672
ZoneAlarmnot-a-virus:HEUR:RiskTool.Win64.WinExec.gen
MicrosoftPUA:Win32/Puamson.A!ml
PandaHackingTool/WinExec
YandexRiskware.Winexe!
SentinelOneDFI - Malicious PE
eGambitTrojan.Generic
GDataWin64.Riskware.WinexeSvc.A
AVGWin64:Malware-gen
AvastWin64:Malware-gen
ALYacTrojan.GenericFCA.Agent.91674
AVGWin64:PUP-gen [PUP]
Antiy-AVLRiskWare/Win64.Winexe
ArcabitTrojan.GenericFCA.Agent.D1661A
AvastWin64:PUP-gen [PUP]
AviraSPR/Winexe.AJ
BitDefenderTrojan.GenericFCA.Agent.91674
BkavW64.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.173356151162e6bc
CTXexe.trojan.winexe
CrowdStrikewin/grayware_confidence_100% (W)
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
Elasticmalicious (high confidence)
EmsisoftTrojan.GenericFCA.Agent.91674 (B)
F-SecurePrivacyRisk.SPR/Winexe.AJ
GDataTrojan.GenericFCA.Agent.91674
GoogleDetected
GridinsoftTrojan.Win64.Agent.oa!s1
IkarusRiskware.Win64.WinexeSvc
K7AntiVirusUnwanted-Program ( 0050649c1 )
K7GWUnwanted-Program ( 0050649c1 )
LionicRiskware.Win32.Winexe.1!c
MalwarebytesPUP.Optional.WinExec
MaxSecureTrojan.Malware.73516486.susgen
McAfeeDti!AE59AEDC4D89
MicroWorld-eScanTrojan.GenericFCA.Agent.91674
MicrosoftPUA:Win32/WinExecSvc
NANO-AntivirusRiskware.Win64.Winexe.hvnzmm
RisingPUA.Winexe!8.1377A (CLOUD)
SangforPUP.Win64.Winexe.Vskb
SentinelOneStatic AI - Malicious PE
SkyhighHTool-Winexec
SophosWinExeSvc (PUA)
TencentMalware.Win32.Gencirc.115e1e9e
Trapminemalicious.moderate.ml.score
TrellixENSHTool-Winexec
TrendMicroHackTool.Win64.WinExec.AE
TrendMicro-HouseCallHackTool.Win64.WinExec.AE
VIPRETrojan.GenericFCA.Agent.91674
VaristW64/Trojan.ITD.gen!Eldorado
WebrootW32.Riskware.Winexesvc
XcitiumApplicUnwnt@#i25marlrzmxz
YandexRiskware.Winexe!uvKYnSArfQc
ZillyaTool.Winexe.Win64.2
alibabacloudRiskware:Win/Winexe.A

Process list

NameCommand line
winexesvc.exe
WmiPrvSE.exe