Malware Analysis Report

2024-10-23 21:17

Sample ID 240125-v5363abgf2
Target 2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber
SHA256 0439a8f2751ae3b3a084ff8df14257c8337815670ba1d07931a2de2fd36cdfcd
Tags
discovery spyware stealer kinsing loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0439a8f2751ae3b3a084ff8df14257c8337815670ba1d07931a2de2fd36cdfcd

Threat Level: Known bad

The file 2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber was found to be: Known bad.

Malicious Activity Summary

discovery spyware stealer kinsing loader

Kinsing

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Checks installed software on the system

Drops file in System32 directory

Checks system information in the registry

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-25 17:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 17:35

Reported

2024-01-25 17:37

Platform

win7-20231129-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1df312ef56fe8faa.bin C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF641.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index142.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index142.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD672.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPFDB0.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP25B9.tmp\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1DCD.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1600.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 010000000000000040d24b2fb54fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{84185F30-5AAB-428B-8795-8B9CB3F307AA} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{84185F30-5AAB-428B-8795-8B9CB3F307AA} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2720 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 540 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 540 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 540 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 540 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2612 wrote to memory of 1844 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2612 wrote to memory of 1844 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2612 wrote to memory of 1844 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2720 wrote to memory of 2788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2720 wrote to memory of 1948 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 248 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 258 -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 260 -NGENProcess 254 -Pipe 264 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1f0 -NGENProcess 268 -Pipe 258 -Comment "NGen Worker Process"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 26c -NGENProcess 254 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 250 -NGENProcess 274 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 278 -NGENProcess 254 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 280 -NGENProcess 278 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 250 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3627615824-4061627003-3019543961-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3627615824-4061627003-3019543961-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 284 -NGENProcess 278 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 284 -NGENProcess 250 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 284 -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 284 -NGENProcess 280 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 284 -NGENProcess 248 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 284 -NGENProcess 260 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 270 -NGENProcess 248 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 270 -NGENProcess 284 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 270 -NGENProcess 2a4 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 2b0 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2a8 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1b8 -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 240 -NGENProcess 248 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 280 -Pipe 1f8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 1d4 -NGENProcess 288 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1d4 -NGENProcess 290 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 298 -NGENProcess 21c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 298 -NGENProcess 258 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 258 -NGENProcess 1e8 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 258 -NGENProcess 23c -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 21c -NGENProcess 2b4 -Pipe 2a8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 21c -NGENProcess 280 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 260 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 2b4 -NGENProcess 2ac -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 280 -NGENProcess 2a0 -Pipe 2b0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 280 -NGENProcess 288 -Pipe 2ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1c4 -NGENProcess 284 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1c4 -NGENProcess 1e8 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 29c -NGENProcess 1e8 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 208 -NGENProcess 2bc -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 29c -NGENProcess 280 -Pipe 21c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2b4 -NGENProcess 260 -Pipe 1c4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2bc -NGENProcess 2c0 -Pipe 20c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 2bc -NGENProcess 258 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2a0 -NGENProcess 2c8 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 2a0 -NGENProcess 26c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2c4 -NGENProcess 2d0 -Pipe 208 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c4 -NGENProcess 29c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2cc -NGENProcess 2d8 -Pipe 2b4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2cc -NGENProcess 280 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 2dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2d4 -NGENProcess 2c0 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2bc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2bc -NGENProcess 2c8 -Pipe 2c0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2a0 -NGENProcess 2f0 -Pipe 2c4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2a0 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2ec -NGENProcess 2f8 -Pipe 2f4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2ec -NGENProcess 2d8 -Pipe 2d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 przvgke.biz udp
CN 112.20.240.0:80 tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 172.234.25.151:80 przvgke.biz tcp
US 8.8.8.8:53 ww12.przvgke.biz udp
US 76.223.26.96:80 ww12.przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 officecdn.microsoft.com udp
GB 104.91.71.136:80 officecdn.microsoft.com tcp
CN 112.20.240.0:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 34.94.245.237:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.168.225.46:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 34.162.170.92:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
US 104.155.138.21:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 34.41.229.245:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 208.100.26.245:80 gjogvvpsf.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.174.78.212:80 damcprvgv.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 34.41.229.245:80 ywffr.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 104.198.2.251:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 34.162.170.92:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 34.174.78.212:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 34.67.9.172:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 34.67.9.172:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
ID 34.128.82.12:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 34.174.78.212:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 3.141.96.53:80 htwqzczce.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 3.141.96.53:443 htwqzczce.biz tcp
US 3.141.96.53:443 htwqzczce.biz tcp
US 3.141.96.53:80 htwqzczce.biz tcp
US 3.141.96.53:443 htwqzczce.biz tcp
US 3.141.96.53:443 htwqzczce.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 kvbjaur.biz udp
US 34.41.229.245:80 kvbjaur.biz tcp
US 34.94.245.237:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 34.174.61.199:80 uphca.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.168.225.46:80 fjumtfnz.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.168.225.46:80 hlzfuyy.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 tcp

Files

memory/944-0-0x0000000000340000-0x00000000003A7000-memory.dmp

memory/944-1-0x0000000000400000-0x0000000000991000-memory.dmp

memory/944-6-0x0000000000340000-0x00000000003A7000-memory.dmp

memory/944-7-0x0000000000340000-0x00000000003A7000-memory.dmp

\Windows\System32\alg.exe

MD5 2b253c542579693fe5524f6584218cdd
SHA1 2c21eb17b5c27cf2327ca0d32b58e80dccda9f53
SHA256 d7f74e853ea393a31f59c5374fe7943df2cb2a977e105f85d253a63b12d0df0f
SHA512 cc392b9ef7e32800a90f9dfcda064466bd1bce035dff45c2482e4dfcbdda7272d62af93202e9b886346ddd835337ed13462fe474eb2b955138133c969de84140

memory/2068-13-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2740-17-0x0000000140000000-0x000000014009D000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 3889704c2ec28a06914de8ef29e52de7
SHA1 f5c6dd0237c100ed1cd542e957812347e48e1a12
SHA256 98674103d6f02346eaaee841a95fccb548bed2b9947585e31e50aaeb8bf92f9c
SHA512 59a7e3b5855b5dab4c998e206a637ad801aa5e44e38f71968ebf7eec9f2d5e99a720b3938355cc61a5bf595a283b5c5625a1878fdd834730451eee0c6e6e3c80

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 682fb222a1faf5bcc72ea818931c7e7a
SHA1 a6da09b0de4c012912b79eeb2fe69547ee080021
SHA256 2e92e1e59ebee589bda7a612ad84c4cd34acd72bc3fe7da2ea52c3e047f93008
SHA512 7ae37b00eb6d97ff3f1f4c632e7c02eb50fc082bfde30241cdc3f667519c1686fc0b2bcea3c355d3a99199621978c90ed3f114b2c9183fc17da39207ac87afbb

memory/2740-18-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2740-24-0x0000000000820000-0x0000000000880000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 0194083a6a5aadacb82de1a569178a63
SHA1 a1527381d9b2ed2abea1022bed89d28b9f80a86b
SHA256 ac36355be0fe2c120ca8672996d40c5a8883ff6f82faf755c96d0371ef14c620
SHA512 dbf9cab8d6b49c48d3b0b4579fdf751fbbbdfc38e1d38a66a61c1e6c30fb16737eb1917ea2cee29401c7dc58f42d29c0f64bfcf95b284c3d3c7b18e6803ef181

memory/2916-30-0x0000000000330000-0x0000000000397000-memory.dmp

memory/2916-29-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 94cd1678af053733d80e9aedb7a18888
SHA1 4239a71b8c5d4df330cc750a0fbef162864c1a3e
SHA256 4688a7edc446818f8a837cbd11ab242b31ddf2da3834936cb1d5f3cb87009ffa
SHA512 3947a923bbd13504e4f4f123bdfa4f5f967ca7e56614e0e96fa4617b38e58574a39bff57c2d9f1f28b077580905db77a09ad632785f9a52a2a67cd77c72579fe

memory/2916-35-0x0000000000330000-0x0000000000397000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 5b72b7bc79acf10c5803f3d755053d23
SHA1 cce9370497428269c9062daca1debdf0b649b0a5
SHA256 28e7dc706bbf2d029e086785347e38e3b60b3e8c03b6c1b3abe414973adb2eec
SHA512 fdef78cf9ceeb28d7078cc925412b1a5bc5caef9464b81a5338e35277102187f1405855c1aecb65e9c99cb982bb4a3b8b1b56e6b783fd5fda5ff7bcec50c2571

memory/2544-45-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/2544-47-0x0000000010000000-0x00000000100A7000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 4b4143adb7c2d872195efd14f6bf1a6e
SHA1 aa3e7af8bf4d005ed877136bd955274c24294cbe
SHA256 4efe6ce271eea333babe331ca75a57e96186f2dc58f5e72d08f645a66027ee4e
SHA512 02494ee0cd835a60478477857c5e0b96d621c390d1f362e311ff009518885324403fcf313a038b0709b2b8c72eba3b1ae712484d50e459b596df559065c0eb62

memory/2544-52-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 85139d5804b7915e4413348c08ca988f
SHA1 0b272bfef702c6ab59b6ff80eded9d882e922920
SHA256 e8fdc38492d53ed1ef660ef733739c9b2041af53c823656660c29b138703cddc
SHA512 05c6ba8e232b7fde303dd2c109583c9f112b01732b7212bdb96a821a442ab31de817f860c8e0d138b3e07ac7e28f1e7d28218491c9266b3a76729aa2b15cb906

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 baf700c35038a06df9263aa3f76ef5b7
SHA1 cb3fb34de3f71a33074a1b085310ca60b96bce22
SHA256 3eb56d4d8fd6dec74f812407285cacb69a9a375126c096ad2f0504952d697b38
SHA512 e977dea3ec1067baccbeff4c29315e274eb246b351728615e9ba32d5e05fa131a89b245a573b9419d211fc8471274575a8f495eac6ecae70ee1d0a863fa2f881

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fa3cac8d9c282e99e04bea8474a26251
SHA1 d91801a8ffd4d828d57137e886ad44ff261c1fef
SHA256 2cd27b0b6329a4719184c900f8b0f0ff9c46eb290cf6ba4822f38202f9910b74
SHA512 1680101c014d8a1ab429c61c75dd2409a2d435e3d9621e51d69b2e15a4fceb3186a4f00da8b572f39bd3250832bed6f3acd811d20cd5a2232689eaba18939ae5

memory/2720-62-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2720-63-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2720-68-0x0000000000230000-0x0000000000297000-memory.dmp

memory/944-70-0x0000000000400000-0x0000000000991000-memory.dmp

memory/2828-80-0x0000000000320000-0x0000000000380000-memory.dmp

memory/2828-87-0x0000000000320000-0x0000000000380000-memory.dmp

memory/2828-82-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 518c06b41f7796c007a1337ca93c44fc
SHA1 b9e8a9d9eb627a72873520943d8c3a7b610ad65d
SHA256 b8b73dc2becb2e2e30855473c7b1a2bb3b754032570f3197ff27bca81c6544cf
SHA512 ec3fa703352cafe98bf1414f46ec136cc869bc48fefa6733cbc5c59712d7269e476b4d908e4ea3bc15d3d0be30f8de792f8ba0dd7316c312c5e07847b020d414

memory/2068-88-0x0000000100000000-0x00000001000A4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 5619da14893bc98f620fd242291bb3ff
SHA1 8e90bc5e2d53b2e32b0b6383898d474e3bbb4b6d
SHA256 dbead2506abac6932b39b376f89d2736baa2f40348869c17b2d6dab03f8ca956
SHA512 57340ca3504d96a6ffbd9fed935282cf678853814991ea77660a1b20d7f7cb0aeb763fdf9122b86d733f8f4ef9445a5fad9d0c89946fd988d625e554d1c52fdc

memory/2916-75-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2544-93-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2740-100-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2864-102-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2864-109-0x00000000003C0000-0x0000000000420000-memory.dmp

memory/2864-101-0x00000000003C0000-0x0000000000420000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 2dd8eb322c4290519130aed7e570fd9d
SHA1 99b28cf18ec7fcc15f8d61b356a5c94af13d8bf2
SHA256 3b0c581cc70b2f5fdedf77c0b4418a4dd24268aa2c4444758410259f3c649bce
SHA512 4e3dcd15b7614e9c3b591aa4cb5fc6f4ace5704dda88b56e586e4061677eb94d7c8a64fbea356091ad40ee3ab6c8b44f488a46fcae026a56384aadc6c1306568

\Windows\ehome\ehrecvr.exe

MD5 997e4d95c451996868b1213ecd20ff59
SHA1 837095b00ae7a01c14246dc0cb777b4a7dcaaecd
SHA256 cb8b5078944ca24d34cf7d41f599cb1daae96b5c635f712201cb779d970edd86
SHA512 a18ffd8b567cee0430f9cdb18322b6059bd0e1e970eeccb65e6f2db3f94b2b453ead77894656636ccf554c1731370ba3161c9d0a43f728ccf564203ff82ce881

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ee9d75f90f8414c67d041221d2fac98c
SHA1 749d5a48d9364c459500f3bc2836fb36eac5362d
SHA256 3dc44ca741d22f78fc042407ba3a5cc4235ff73b7efad5325d149399f3f64832
SHA512 22587d53a2389fa2d9f79c5081875c349fa27458e9f6e0dca9313b97b834e9afb86788953852f2fd68d1a7a7891054776b863200d8d5be039b20b6a0ac70bad2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 14cf18f5d64befff281636931d4b5598
SHA1 b117411161ff2025574729aa47231a946c25f28a
SHA256 66233565994384bba3e13c2cf48c66288d7a4e6648814d1e69ccd16e8a351da6
SHA512 c53ddcd5446ba5d736a58661436a321577b83a3b0418e172fdaf26d463a7555ae8e5d1ccab78f3c086e7e997d6cb0197a568a80f9ef99f9fc8da3bb8c756f9b1

\Windows\ehome\ehsched.exe

MD5 63533d02350b3e54655bb866fe7c637c
SHA1 7b7efd10bd0e32b7783ea62544379be4633d9b18
SHA256 0790fd796246b292b8c0b0dc6b7b4635472ff29947972ba32afb27f180c7b86b
SHA512 dd244d3735b59a18d26e46699b6b502234944937d871d14abe6b1d9a47a30ea5969806d92973095de8a82902a9094fa62d4f1edf3b74ba9daaa40b23c5a70b9b

memory/3040-115-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/3040-116-0x0000000000280000-0x00000000002E0000-memory.dmp

memory/3040-122-0x0000000000280000-0x00000000002E0000-memory.dmp

memory/2864-126-0x0000000001A30000-0x0000000001A31000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 00b29fcf943e5245376ea82055cb336e
SHA1 c717ba4539fd82f9e7f7f993753b1451bd726679
SHA256 72f2ba7bc4f99bd49522befd27d421e969693e731a7c2c3589700dd7dcef386f
SHA512 98b560622077b081d069b6065138782a3aa2b9f97fff2d44910a02db0a41f98f39a5016f2117f10d485a2e63ae00ff0c7584c30a4f2d03c7d2d622f1efbabddf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 69c0c502527d3c224d8fbf55a1d2c15d
SHA1 c5648be3c0fa42d51c433e4c5e6815df7418f46b
SHA256 171ba6829fd74dd616003accd62d11fb7ef22ba4e51076b92b66be84775f68e6
SHA512 634f3559798b8484deb0a73e2a36a4d8683f91ca84ff7fd01e9779448fe3b1a04fa11fab42a7d88be5b2eb9971a21ae4b9017f1d815bd5c4ac448b77d78283fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef8e084012ccdad2477268a061df7beb
SHA1 57d2bc2b67134989a931863c5e7899d562e7c696
SHA256 614ded630015523031c12d02c784dbd6a4914e5139781aa06c40ec2c727a3799
SHA512 045742f83360cb43ea50d6b634537fcbeadc1d2558337825f38fee547b94baf4e0d18e3e40b63e758cad849905f8e6dca79cc3dddabd6e62ccdf5df2555f762e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/2772-254-0x0000000000400000-0x00000000004A8000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0f1e9c48869ac4a3f4f36089a1ea6033
SHA1 b431d3152b2c0d3ab3b31e4d9f3de76079ef05dd
SHA256 353c5eb76d3503218443bdc04fc4f804d147f5ed0d3a421bf6bb2c4c69d558db
SHA512 05e582087bc69c0ecea180e1295e04d16a99094a59f2cf559397cfe7c4ebbfb851a225e16511e871a4ca7ba393cff4e6a1b5dfd6fe8ba197814323269c631286

memory/2720-261-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2772-263-0x0000000000A60000-0x0000000000AC7000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e39c4c0c4af0186fbeda9374b8e69dea
SHA1 c70b04da840b32f3cd49cb048a77b696ca333061
SHA256 4cb381dcf6b1d4ef85368cbaaabdef29d825c8bd88c12c54ed6a09e646db8561
SHA512 f83953c8b46818c57d7a70503e61b19ec5c74f23ab473814765316701062b86b292640db14c9d322be5b83fce01a2742bead2ed67e7b0d680ab2582a6029657b

memory/2772-338-0x0000000072CD0000-0x00000000733BE000-memory.dmp

memory/2828-343-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1584-345-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1584-350-0x0000000000380000-0x00000000003E7000-memory.dmp

memory/2772-352-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2772-353-0x0000000072CD0000-0x00000000733BE000-memory.dmp

memory/2864-354-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1584-355-0x0000000072CD0000-0x00000000733BE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2216-359-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/3040-379-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2216-381-0x0000000000AA0000-0x0000000000B07000-memory.dmp

memory/1584-383-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1584-382-0x0000000072CD0000-0x00000000733BE000-memory.dmp

memory/2216-385-0x0000000072CD0000-0x00000000733BE000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 da127847de5f52289fb523715fe02787
SHA1 439590248019ee71cf0c5968aa40243f324b0948
SHA256 93b582c02be32898ed2fac460a639caa198183f5e55b908890170992ea0fbf65
SHA512 c52c46c297ae24ca3c0740eef62a546eeb9db2ae9ee798472ab332c7b6c896286d4cb5eed128d4c4e60ae2e24c5e3facf1ef0ca722d8bfaf96f9ff8af6ebea28

memory/2864-449-0x0000000001A30000-0x0000000001A31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32.cab

MD5 a620a25286339c928ebd242985905a8c
SHA1 d8223505a0716ce68e0e7984c0192277352991d5
SHA256 8337a932bf3a4483b43be6bbaaa30554d3ee9e1a041be70451bd59f08182fbee
SHA512 5d3b301432dea5122f11137e1071bcf4931b8de55d35bafe6a9393a005fee2737bbda3ad5c2f5fb5d486b8dc1bf28637ca12d9dee3ef0a339e35619df747e26a

C:\Users\Admin\AppData\Local\Temp\OfficeC2R5158CC7E-314B-4A61-86F5-6412E2C5E8F7\VersionDescriptor.xml

MD5 adbb2c3f044c3ed52474e01515211c13
SHA1 cf2e1bc2d32247884dea1891f93bd911264a6c4e
SHA256 bee79df988b8c342d79abf57b77dcc301c5da616d6019c60c70b8c2f52365dcf
SHA512 abff080680f14f95a8780eddb4bef9a79d118f94e1236310e7985d6877675ae576801c59aee62e89e755b830ad2e72c7833723d3b2e1f70f487dc0e9f9aad689

memory/2276-473-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/2276-452-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 5ae9926dfff08583dfc4b26a21b393f4
SHA1 06fef978088e14a997e7fe3077daec03fe6ffe58
SHA256 5985d7ef5b6db88f749ffdb3fae5047c9647e64e5456ae46f26a4cc8c48ee9e1
SHA512 a8cd64e47c85099d60dd326073a622ec5d02ed40b3f36d1e27a6a98895742a8876254fae147a16aaa33265cabc0e3ed32aa9c63ce83dadc5ea83e46e382ae388

memory/2504-478-0x0000000140000000-0x00000001400AE000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 58cc59a63c7fcedcbabfca48ce0f7f48
SHA1 9cef91d9eee124c1368a769c87a52bd44a514963
SHA256 9cc183d453b3e446ea2d48397423d8bad918393d317114a26a1dfe38c7984830
SHA512 96d2562b1f48b2008f389407779a2253c92fa6ab4f9ca3786602e18e4e6d9df71f90851e8702ed3a52c80d13b13935e5762a577c42e4a863465c8ebccc2137fa

C:\Users\Admin\AppData\Local\Temp\OFFICE~2\v32_16.0.12527.22286.cab

MD5 91ecadfeaf460441dad9118a5b3cc60f
SHA1 eabc73224a5e3b4bb185f3ed65138840d168e954
SHA256 e1f57d838559920bec185d3e6d5eee10d9b3e2b53f14b16d6236ad2604750b57
SHA512 a57265e121794646a70f39d47f1f97c34cfadc56955c91854320e4632e2098e14a7c7c797c7a91c9349aba4394d298d4ef6c4489fbb94159e1f20ded158b762f

C:\Users\Admin\AppData\Local\Temp\OfficeC2RA9544A50-D6DD-46BC-9383-02CFE28B7AEA\VersionDescriptor.xml

MD5 bb60324022802923266b3568f5e34752
SHA1 f5e5416cdd8c467a87516c5fa15680644885526b
SHA256 1e5da48ff5ac445abab7ceea569f91b1c7e0e0e89a99120f41b687715f5bb219
SHA512 4f2f0689d913f46cda2a3075d9571414c945db5270ff6e32dbbb1939e7cb46b09d89f1d4b739dd233ba1cd392a88e6f21a83024fd3ae05abba221fba9cb8d86f

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 1125d2265816bfbb38150963bf5e97d5
SHA1 1a584ebee12e77e9d00db353ac5c15a136bc1f9a
SHA256 80cf415d227bca8192090f47f4a5dec992645866c7c3b63b22b7bc7ebab5d0b3
SHA512 d23e91206ff74e5535af9728dcdd89d6b05bd0edc2c7562933b56673d5fa0f916f38110b726e4828ece5347772712dfcb060a39c2fd76dd7cee9fb36bd98d1df

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 109fc7db684f887882de37422bf6507f
SHA1 6888270c09caaec91d24e261234a9f325b7df606
SHA256 07a79c39db1001d10debd20679a6af64a867296e9a3fa342b700e55e10297831
SHA512 5acb3fff377cf1c522c928fdb174f3f445671437971b845b0ea19b15a14e1dde14202222936dbfae10da404c22bce105026c96944697f8e44d78166f1a303dd1

memory/2756-504-0x000007FEF4170000-0x000007FEF4B0D000-memory.dmp

memory/2756-507-0x0000000000FE0000-0x0000000001060000-memory.dmp

memory/2756-516-0x000007FEF4170000-0x000007FEF4B0D000-memory.dmp

memory/2216-518-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2216-517-0x0000000072CD0000-0x00000000733BE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b86b2e73802073d624a3228a11b7246e
SHA1 c1f18519f8cb53e80f6ecc4cdf348a50c10f87df
SHA256 7908083ad09c6633fc65e9e8ee8cf2abba969aca0a814fd8cec0e95f5bb49cb0
SHA512 e9b03033d1d1b4df661fcee743d19e3d0ce6c7b69049fc359175721d358ebeb11d26a2d094989d2809e712df03521ea9d8c2b88d78873bfe520672c898485cbf

memory/1352-524-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1352-526-0x00000000002A0000-0x0000000000307000-memory.dmp

memory/2656-529-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2908-531-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2908-533-0x0000000000570000-0x00000000005D7000-memory.dmp

memory/2656-537-0x0000000000A50000-0x0000000000AB7000-memory.dmp

memory/2496-538-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2908-548-0x0000000072CD0000-0x00000000733BE000-memory.dmp

memory/2496-547-0x0000000001020000-0x0000000001080000-memory.dmp

memory/2496-555-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2656-554-0x0000000072CD0000-0x00000000733BE000-memory.dmp

memory/2496-553-0x0000000001020000-0x0000000001080000-memory.dmp

memory/2204-558-0x0000000140000000-0x00000001400B6000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 32e57eed019e22fd69ce57713fccb5ba
SHA1 244d22706f0e5fce12dec1944b6e7df338d9bd1e
SHA256 224947acc5657fc0e936263ad5a5ea937c1a18e64be2ff4c57769860616348a1
SHA512 7eddee711afd329e9a6d485110893391f0e8d2efbf12b19aa5f17ed874d11a3fd0f6b61675ca656f06164376668bf5a71eeb2cd4b74aac954b28c4ad381669eb

C:\Windows\system32\msiexec.exe

MD5 c905f503d3d8fd6bf9cf65f568b31a0f
SHA1 6ba7230172fcb2461e5957666e109eaedf4889db
SHA256 a8fefb23ed0d302e349d0db616713c018fdf02dc145a989591c69f43eb2b6b71
SHA512 2ce57d5eb0a9511b235e10ae9a246221cbd6eef47454ee8f5a773850246fc13753fb268ec721dbef79c56e91cb6bc2419d3da8088fa8780b906387f72ac8b3fb

C:\Windows\System32\msiexec.exe

MD5 20bf27594d91e20b1db9bd699a716ad5
SHA1 f4b1f89e8b9ea46b484ea4d5b789612e67420cb7
SHA256 662e755bb5f2f9acad11b354dfccaf4b00ade316b48ba8e54ead51c932761258
SHA512 67648cdcc0f5da55635c4ef85738e206a4b26ee05bbe327bbe3003e38dbb4aeff717b6380adeabdeda7f93ae4b47a1342ea5919553c67364f97b8d492059e502

memory/1228-568-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2396-570-0x0000000000410000-0x00000000004C2000-memory.dmp

memory/2756-572-0x0000000000FE0000-0x0000000001060000-memory.dmp

memory/2276-578-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1228-581-0x0000000000620000-0x0000000000687000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1ff688d6b153f34f9467853009a3bc37
SHA1 be99199e2739cf053e518b264d860da938c7e7a4
SHA256 926eeefdc4e2f562e0383a89577b1f45d0987852653d7294437ffea36ecece3d
SHA512 53766934205f6bd2dfcdd39f34ab9f435ff5f412eb643aec353c2c5d9974e6b72e0cbb9999317aa40b19e30b303788073885071e88d14086aa4a2e5f647a3fac

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 44189008aeb71a40d254ba8a4aa231e6
SHA1 d2197a06f26b19c2739ce070c8aa939403d4f008
SHA256 d788b6429b58dc375ad989b5b1d88e9ec59a4e6423e43d180ff7f083a7743700
SHA512 9d344c200b37d93dc371b85f5bdfdc9fe282ee70fab3c119ddf33e6522a6b8ac1d3a6fd729320f55ce292ec11b69c2aebc18d15a9513be85d597071fd9c37c37

memory/2756-585-0x000007FEF4170000-0x000007FEF4B0D000-memory.dmp

\Windows\System32\msiexec.exe

MD5 f7680496b3c7df233db669331a461807
SHA1 612b55c6b89644a5d44fb0e147bac3bb710a46d5
SHA256 21087b34d908236b98526761aaf5e91955d6355e1de589a287c41949cd17a5f7
SHA512 fef48e47faf9051fbe5e1d40d6d2cca91281b932d291bc36d44f1e039b6d171a0be96d8b3038290d96ffc846ab83a5c5549066b5f6b780c7c21473b1f9cd2741

memory/2396-564-0x0000000100000000-0x00000001000B2000-memory.dmp

\Windows\System32\msiexec.exe

MD5 5d873447a616c741a5e73ec4d419c47a
SHA1 46dd73cd39dab13aa0f91f56abc4f56fad88ec5d
SHA256 c3b9c04f95355d6bd1d1e5072097e23983f6fb9ba4626cbaa5812cf7885b0650
SHA512 21c2d3334d6bdbd034bd4b1af977dd813c8b568ab2a3268cfd8c159c57ba82bdd3b28641a95eadc7b7dcfa4dbf680fcd0d0e6d7124592ffccdf94ebd2ef638f7

\Windows\System32\msdtc.exe

MD5 284e3f1b7ca9800d41134cbfee04f960
SHA1 7fe3623d2d4363006a039d1d9c24af96fd6dadec
SHA256 86c579a96790fe736683822759bbdbe723ee45ab55de4e6df7fc54c4a2d1c231
SHA512 99c78829bd6588e78c46c1419199bbffa88b823708270c88b63096cd8f11f9faeca28f4ddb1b43e61929f3321bf0191b286c5a8c2b344ca97cce094f751cd2c1

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 d568ad46ac2393fdf70ed0952ec45652
SHA1 92d0633d6af5e71a836ad551b45a7477a9c8f064
SHA256 aaa2c410f603d9a5aefea7f3825eb85be07e4dcddf40190fec2c17bb2aa75a58
SHA512 80d1df1b51fc7772b4968568600533fb21b2675ff1cc2e79060d5ea216b39802111219da3975a7e88338da6278e88677a128f8f61385a57157990efd44984950

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d8d04ce85c6748cced9b4aae9e1ac2e1
SHA1 298f6fada3911c2dac229e7d358b1ae867d611e6
SHA256 c71d81026228ce0d3709036090e69509e457edad90ecc3ee6322bca353d7dd8f
SHA512 c628e703c511f59976df0979d7fd0a4d786950d5289ae341edab25b765495b09f1016a14f4bc7410a551bee8ed52eb211b33478c87a65789ce759bc399d45e61

memory/2908-528-0x0000000072CD0000-0x00000000733BE000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 3cf1861a2b73643c8bf6787ea2900349
SHA1 948ca9f4d594c4b8548ce422f3031b612a356493
SHA256 251a3f6f09a5652bf5e336decc723012bdc9933a71160d77af182a2cae6952c0
SHA512 83ac20de260d0a38bc4e916dfb10f70006f3cd237d8b94eaf09bb7401bbdef27d07416643c41f53cee28975de36bafc6146f516d3ae8bf9b1be280fe7bfe85a2

C:\Windows\System32\Locator.exe

MD5 863caeb08ad417a6ecc1924c65478738
SHA1 bb6a17436eb892ddddec4664f603533758f28405
SHA256 707c02041ee684c83dd8890756c4d3dc1b6cbeabc396bd165e6252b8de8e4734
SHA512 9c85192333352cb6634a495608021274ef7cc6e6d564dee834fce69047d7d2f534e8bb025794806877a8da6e7d85722cd9ad7719953a150d9e6a86339de01ff1

\Windows\System32\snmptrap.exe

MD5 b3e6c2a3abcf05fc251b0c4e374c1be9
SHA1 c173d2b58556d6162a2c01037a2dc07765700cb2
SHA256 7cc343097ed8f6a90a95d4ea12a31011ebbde3c9c190b1fc66a03b8007afaa0d
SHA512 490fa37f13abf356ae5bbb51a82a1795d3704d5d39c8193030a48ca7bf3418e0d3a1fd17f018198506c0247557750b189381e0d6ff71335611cfd44bbfeac00b

C:\Windows\System32\snmptrap.exe

MD5 6c33e0309297790323390da112dfa823
SHA1 99e4312998caecdf6b6bbd52fc42178d6b59795f
SHA256 0e2c42cb060fdba331e1e04407d37b2733185e83ec59243d8ae366d16374b0a5
SHA512 1698e7a084a061759614f75b152c41e6750717232d5113e3b6404547fe821f7f63eb70012e57fb6415b53cdb6d3173f044f3e53fdbec2a2727e36a244def428f

C:\Windows\System32\vds.exe

MD5 8d11ed4c7b32cf45517b9f70f8369dc9
SHA1 00e627a654a3fd5a98839be0293cf3b5ee032b39
SHA256 7fe7a40baf88fc4b4164f641385ef22d86858e7dc28120a343a334eed806770e
SHA512 847eb46e12baac4cd79a01f74078242565b436b9121b166fa630b682683dfe02585b3dc13b1f30a933b2e97b66f29dfec845975626cc5fd1ee967a5ca3e92618

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f83aefb6d1458dda97cdd5d9c7d77e8a
SHA1 8d377e909727a3bbb07c5a26c6c5be5274b0313f
SHA256 c20e2599cc5ca2fbb08916691594f7776a9a0df932314ee1e7cdffc7859928c5
SHA512 1dd0e3b19337a3fbe036ea7de2a59e04400b694ba14f82dcafbc59f858b1ce7d3ee18a43f5073c45c1bdab92ae11a247333ee1812d2d886ba38aab8d862c0b86

C:\Windows\System32\VSSVC.exe

MD5 19e2f38f5d8b478e25cc79cae1f05064
SHA1 4e7680bc74ee5a7c28da5a22b8ffddf7fb58b58c
SHA256 9198c37f395f7bb33da3590af37011924f9deda7dc40c30d994fd3c1b9378da3
SHA512 31180289324f0304b71454ca26c7c2ac2ef828c257edf4d4943e4e22af5543878c944c4d97f476f3a6164824b09c35c15e008932fe7fc5d5d71d890f2750fadc

C:\Windows\System32\wbengine.exe

MD5 7ba5ecbb0c328f23eb8234db79b39908
SHA1 948338d86f556fc1495df0e06cf4d4d0a9bafdf7
SHA256 8afa589cf9d3610193671e9eb1702961896aa6cc5fbb198289d15baa2bf3015c
SHA512 7cc5ba61cce149431098223ba124da0dc34a079a26af7e2e38c1e01c905b5c34bb27f52140808cea302d638379f0a2648344e1ebf30f6089bfae263e21afe5a4

\Windows\System32\wbengine.exe

MD5 887f664e8414cc3971f5fbbee18d8259
SHA1 0e6f864899a00f25eea4f81c2a55e499d282ffa5
SHA256 df9ea7fd64df887bca3ec708daa22f01228187d32b05acefcaa49e9ff44ec72c
SHA512 5257163c61859ed9773e6b2ff92a2f3dc465d86f094ad110ba213cd7915bfd51d8814929a961d07dd63a9e66cc2c21e2dc30fc0df59100ee7759403197b1b99b

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 19978333328ad1dbd707d2015ba17978
SHA1 91d8c1fa69c28c1d474caad1ea337b94140763f2
SHA256 991aa856623e1607926fe3f746809961197f580f080dacf184689a5e07b03736
SHA512 06294376473aa77368290309a32ce1100447046ce1a9f4fdc781af2e8be277214a14accb9c96d30f31b0807e04ff1cce7aa8dd8df014fe8ba1e2a2b4808e3a93

\Windows\System32\wbem\WmiApSrv.exe

MD5 2659a0fb97c1cb3af4908127d2808932
SHA1 ea7621a502b0c20f27f90a7b639305731c784abe
SHA256 537bba129d13a34f13833256f992a3be8994e34c38c8d64c52cd85daf1a208ae
SHA512 ec219b949eefd38e2377a370100f3f555ad5ba1e8d637af9b8e4db8420faa85520c2d549fcbc229d6253c37872baf9e4948520a015abb08267cf3e12c90d4a4d

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 97bd8967644fd7036fec8faf1541cb21
SHA1 4822e1d2a0d6b511a114a6dd028cbc72d0f62c48
SHA256 ec84acb1acf16c1c07a304607451078c13df8c6b99b684e92acf4cb90959f35f
SHA512 98d11531363b016a6a344ec0e198472a487acfa2a0f43fcbb2ccc175556bc4391aeb08d7715b0f54db85ed15ab5b740d6253ff98e37c197dc4e46a6f6f4a14e8

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 cf252fa5d2add7cadceb9de147da5f38
SHA1 4c4d152ca621dc186d39357c27b1de7324f7cca8
SHA256 559cf8e11d6f028d52c19e285c21d25d1e3ceb7cca1b5f5c2637751e930087bf
SHA512 77b5f2196b2a18a1a28dcc54c57d8b08e5cc0de0796328b9a6611db5d21a2eed2899f1d8294858b04714093582a063b18a4f9c83881ab0d56452f4822be84b8b

\Windows\System32\Locator.exe

MD5 42788b7d4ff999176c615068113deeb4
SHA1 c457e0eed89dc60dd8d47e626a0c7afe5a08c0ce
SHA256 5db9df9b7a3467a0dbaded58c440c3c3984d2461b6c7f5949ab3ea035c50ec54
SHA512 a6489a010383134e02578d90ef4580831441f1919f4dc5ba2efb377466813be64592e1e91346adcca2c3bb2618465c4ca5f65461273ad00f4ad3aa08345c3932

C:\Windows\System32\SearchIndexer.exe

MD5 a24c088d7d1f93e23d6b0c937b98d7bb
SHA1 07f26922bad8887d90824ae212855809e942475c
SHA256 9e85822e9928e6caafca7be65461872eeefb828e91be76c42754e4749d76d6a2
SHA512 51158bb503f9adaff989ca0eb5009bd054138e3e347c83b7cb730afe259550546893932bb9c71ea3d9e87c0e90ce1fed97b9d23c97647055f846599c241f233e

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 286549dbee3edf79e9218f87d1bf0212
SHA1 42da18a205e9ec73c9315a2636b5b71642388990
SHA256 79c8250e1b87d4c12736f16b4b8077bf76fba9f807e1da569b5e19d0b20260de
SHA512 67b10e02588ed0272ae7bbdef963c0e1d9596a1bfbb8e6488f1eeb227e651b74be5f4270656e45e3615909c01f919053f01c7055eaa873d3dd04c9a3094979e3

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 423377861a91b4a1fc9cb0589e746b9a
SHA1 93652379b30d92e05d072bb767e273c56ea6ef2d
SHA256 e3894bf4e7a3c107c92ec6b707fb983f0f4a1a28a407e636cc12dc1b80a67071
SHA512 9b17ceed1c8a432b3b37c33cf8d8dd9f847f1dec42449ac64001f44911ec9e0d711184d8dc9f66ad09d3c61c34049d9cea3b7246368557365014b4243e78866a

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ac33ef2ef40344d50681ff654fc046d0
SHA1 55e86bd637fdef78f64525c7a4674b6037c24d84
SHA256 39a4626334e0e4dea948c727bb5eb8c0f63479cdb88fcbc9b74d5baea2359d3c
SHA512 5aef66d3d755250bd9ffea696a153341326bfd047b0d68697f5585927bd3fc28fa5a5ead0d94dd65b3aac4b25b7d21359c37786a7b557bd1cdd5a3e2d01aad21

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fd9f36993ed2de4827e9d46cef7ba9ed
SHA1 396788940965dbc74bdb385e2a30a6a8d6d9aeb9
SHA256 a9c2eaa0a3e9c2ec386943ef98d04188ef0875efd4414446b1231e96b7009153
SHA512 bee712c3efd5a596181f0e050d52d4780d93b31964cb344c609ff18ce8a8aa45f1df264407bed7ff707b1e96b6419af2f2149c0dd5ed2a21d6ccbb304f917c4c

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 f15b4f1ca1b5b7446f7ef0db19053c5c
SHA1 023e34b497a19e74f4a082027ca6662c76238bb1
SHA256 dbf19ea19fe91b6bff862feb987298dc62b999fb92a8a3a29179fc62bbb11277
SHA512 c51c675252a93c9ad877ff88929fec4e220b72c2cf44eeef4b9fb0a7af0736e2dea087d11b2f0d4a7b6091ca64c2395d3085ab80593f9268c7e32e2f3d4d9044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 c90140d8d24ab9d191fff6ee10ac8324
SHA1 e047ee6a73e508c584c6b66f306573c82ed44ef0
SHA256 6746006210f3a8b215367e9669a0dfd34c46454bc083deff9569f2ad727c6f6c
SHA512 c707dad294390ea7b81be989c3d3f7353b6caf30d9fa51919b68ecda966360e9727e965f0dcb583ee5e940ac7119c6b8ae548569dcc9008ec6021f93c5df8d16

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 dae65c70d4c7375cca134f1ff25d3ae1
SHA1 f4d5c0e6958a488b4e50b7604ab29e12d57e0fc0
SHA256 f517f33b825e807d60ad54cd31eb6358c4f0addc68df650fbd89d5e33973e303
SHA512 987a42e34beacf4870a16754028b1f1ad117d0b56355bc2d40626bd95b2a085b3a1ee01f471a32545dad061b5e269fd9ca8eff5f033d3b4e5847073dc65499bb

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 78afaa2fc2e8c7c4ab37af9da95c0205
SHA1 e120c70eabed105c3583bf113c73f0fbd499f151
SHA256 0c2e93be839eb1a5c3f8179d90edd9daa3560247caf01ee8a82b455eb9c78f1c
SHA512 539472cdb25ad71092a3c6abb9ddb1b8bdbb0962058afe4bad4479bc528c4d4069da094e154e418a6aca6a067c1339d7e904ea348a8205139c4b715c7a16af62

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 488277ff0764f336cb3cca571ff519ca
SHA1 bdc5dd04a74deb10d586004bddcc7cfcee009ce9
SHA256 f94d0b7239e939237e6513013c3f06ff04f898d94ae9f954d6080fb16f9ca092
SHA512 a6f324d80c4c6e091db4ad536b744d1c9dd1c2fa810366aa52fdb474ea3d76e18c0dc53b5b2849554528f538b5a0e8b2a3383f51d0acacb56551a05e3a9cdc9f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 763b888aaef9d8a1c099c13839aa5bd0
SHA1 39d6b8253e597eae2641c40e80fa11a04b5e9fa0
SHA256 53952956b7035dfa61cfe48b6f78aff539babc41a6be8ab6170f6429d6a9b040
SHA512 7c8e527250a5e6c9595ccff9a9522d11e2df640b36f8365e2dc5913551018bb790886e7c912709e6f2312ad673421010a79f2e43b1a3154d5f2d6af171919615

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1cee6251bb37aae274324f195045968c
SHA1 db5747dc3e01c5dda9201cd64cb0c91ee8e6256e
SHA256 cbafe688a4ffe2983bf6864e8aa1eb5791aabdb7ed2b252ad139b6bb799f5428
SHA512 ae227ee47b0f8cd79450cc036f5ef77d0d0c5d5d85e1ab4c49fe6caed81288ade4ebabf8a7c9e8954d2cacb81952662f2bee457b898edbaa2c710f2f466e7a35

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 63e157842225f34886167e812693914a
SHA1 41ad971bd05f9bb9380b15da0bdb1837e134acc2
SHA256 d10e25751d090bceca9d14f817f90db2eb21352f738d30d936fafc9fc9e8a18a
SHA512 3354309467f8da132cf02c5611396e5b1ee2e0a6846484509671eb8a1018f8662706a7d6f584331b8ef572d20105c5ed052f13828548d44bc0ae78fb7d216ed0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0d8876cabb6934797423fd1729ad89d1
SHA1 12f8d550a6ce574adb96140a4e838a491921d85a
SHA256 ac8837763b04a77bcb1697b4912298d4f115a8e6d940e20817860b1f939a0835
SHA512 8bf4dd64f3a18baed6d31053271638d6c72d98e9f73501fbff6e9efdbbc033f1565a08247cfcdf4cfdc8afcf3820bfe03bb5dab718540a33e98facd4f2e2b3e4

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 8c8ea6edfe196fee1ce091f6975159d6
SHA1 a226e50788e6446d4b68b3aeb0370fb3fe54be58
SHA256 64e55f6cbeefd28c5c47f0818a57b92f81a020879244def89e62d282c13c5fc3
SHA512 02a851cc7c8722233c45cc512291b74ebef23bd3899d159e73c32478f824169b7e10663acd87a026734dbb658e388ba68ff29e73950ceef2f5ca667f25e8393b

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

MD5 8c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1 b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512 825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

MD5 4f40997b51420653706cb0958086cd2d
SHA1 0069b956d17ce7d782a0e054995317f2f621b502
SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512 e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

MD5 be5475106491ed8187bb8c4b9417a712
SHA1 46765cc3c45e5345c0bb8221b50349a2f6faa1c9
SHA256 14e3ead0d97d41d59f099a0edbbadb89434cf468f4cc7029eaedb87b1ba58f7d
SHA512 7abd37bad3f86f07df5208ffd5d7c3dac854654b3fac3ffc76f555166a726f191eb0f286b5157646a908fc143b47bdcc5b15767c1159d04fe25caa80c118b9db

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

MD5 71d4273e5b77cf01239a5d4f29e064fc
SHA1 e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA512 41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

MD5 3c269caf88ccaf71660d8dc6c56f4873
SHA1 f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512 bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

MD5 ac901cf97363425059a50d1398e3454b
SHA1 2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA512 6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

MD5 e3a7a2b65afd8ab8b154fdc7897595c3
SHA1 b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA512 6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

MD5 2735d2ab103beb0f7c1fbd6971838274
SHA1 6063646bc072546798bf8bf347425834f2bfad71
SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512 fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

MD5 9c60454398ce4bce7a52cbda4a45d364
SHA1 da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512 533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

MD5 c26b034a8d6ab845b41ed6e8a8d6001d
SHA1 3a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512 483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

MD5 aefc3f3c8e7499bad4d05284e8abd16c
SHA1 7ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA512 1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

MD5 0fd0f978e977a4122b64ae8f8541de54
SHA1 153d3390416fdeba1b150816cbbf968e355dc64f
SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512 ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

MD5 6eaaa1f987d6e1d81badf8665c55a341
SHA1 e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512 dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\24b4805c141426b0fc65f15f30aff1d4\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

MD5 1470cfad13c6f88d957ac9f3b73de9b2
SHA1 6f4d54cb2ff2fa3764936c43b92fd3e313c0a877
SHA256 857ad997562cf6b40648c3be9c3a9377f1833f44e5326c8fbc8939060318fe92
SHA512 a6c34dcca249e7cbfde62bf204542a66d5c88756c320bf2438ea7529baa7a56f5b160a7ed37d56f04599f641c2e7476c428469b19410b6666758606a16bbb31c

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\1f5d757f0db1005daa2dee10d6117655\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

MD5 0357fac505a1028f1b803e4170de3a62
SHA1 0ce8e6445a23e02b8b23e964e3cced0f304f556d
SHA256 c0d079e51a8b642b9e7fea65b241204f4d890ec4f81030b6e1cfc86ac8a2c435
SHA512 ebde8c35ffeb88ffdcf14b0e7ef669acd641822e9b3a919aeb8a29b01237a8b3b44e3a446d4a6b2fb53781e944dee94ae471b94ee12e27a279169d51a87acb12

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c0e67e7ef4fdfc6b88ce2a1b9491fe25\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

MD5 a401be2081f90b100550494bb5add3e1
SHA1 9fc3397c6c74f96be79e86d05e72a7143c7558af
SHA256 01e14f3636e64f806ac0e9f38b3a492826df26b5529982816bb9e9d6c792311a
SHA512 ddc52179976fb6959fc8a7967379e847dece5e9084f906e80409a1329a52b0a6cd8a0e50499116c617462fdd829be0ac99cb6ceb8df3f5a5d9bbe17871c29b5e

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 17:35

Reported

2024-01-25 17:37

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe"

Signatures

Kinsing

loader kinsing

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\42cfa3ea4d74bb6b.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee630ae8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000473941e8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a864fe8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029ec13e8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ceed5e7b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000189c24e8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e565ce7b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0c40ce8b44fda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-01-25_ae7b34e264e11f50cea8e45395ea6f02_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 officecdn.microsoft.com udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 128.36.91.0:80 tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
GB 104.91.71.136:80 officecdn.microsoft.com tcp
US 8.8.8.8:53 117.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 136.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 48.143.43.7:80 tcp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 128.36.91.0:80 tcp
US 48.143.43.7:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 27.243.111.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 34.94.245.237:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.168.225.46:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 34.162.170.92:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
US 104.155.138.21:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 tcp
US 8.8.8.8:53 udp

Files

memory/3984-0-0x0000000000400000-0x0000000000991000-memory.dmp

memory/3984-1-0x0000000000C10000-0x0000000000C77000-memory.dmp

memory/3984-6-0x0000000000C10000-0x0000000000C77000-memory.dmp

memory/1496-11-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\alg.exe

MD5 b86f7fe25a8933b8f38b9b823bfa0829
SHA1 80f90b72002e4fb2dba6e5ee91570f4c99de0d3a
SHA256 358bca3c8abafb76d5354e5c732ffd3161860e6096cb001682578c5865970361
SHA512 ae628106abd4cc47d8ed790be049645dbd1da735d7e0043b5e69f88720a9bbe098044360b7a6d9364124699f6a3c586aeec43661ac38d88f93669e0438351170

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 503cedde2cf0ad8892b509e3bc8d7d21
SHA1 081c1c8d4c99db8dbb1ddeaf323c2bff8ce77b0f
SHA256 895a4b09559e17595f1a968f4a6a79f7cc0840b3c046c665cb174b447eacca6a
SHA512 b8136046e5a22d31e1c9f744a784fab627125a38363ddf701a7ed48f44e10c1a4e8076480b4d6209455de5a3f506e1c11ca35e86ef2220c0fdfa10fb768bcb04

memory/4292-15-0x00000000004C0000-0x0000000000520000-memory.dmp

memory/4292-17-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 7315d9b8075700c3a4b81dd7c757c32c
SHA1 663d283fd9fc04f03324cabe9fbd89e437363ad6
SHA256 25ea78b4de0f91a90dce50ba46782c6f09266d918bda3d32c21dd8f74d591b64
SHA512 b719325aca8c292ab97410a8381ec7e86200f061f1abfc8a28c67262ebd34febdb417048a3c4c43d72c9195e433a9ce273c5f0a296fef6b0da89158802bcf60c

memory/4788-28-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4292-23-0x00000000004C0000-0x0000000000520000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d5afd2337c7b346068fa915ea6a04b12
SHA1 1a3cfce9a11e5a781761eb772e41629024e83ef0
SHA256 711fad98762cd2427d40716fa56f249b915b397b0d7f840d47d001a86b362b19
SHA512 5f7fc25d2c93e5aef4e5ae2dfe026b70d6e6e25a2c29fa549944d87ac69f8d00792a98f835dee82427d97ff6ddddb2fd5412801eb9339ddb62e1c21b1d1215de

memory/1508-31-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/1508-32-0x0000000140000000-0x0000000140237000-memory.dmp

memory/644-40-0x0000000004ED0000-0x00000000054F8000-memory.dmp

memory/644-37-0x0000000002560000-0x0000000002596000-memory.dmp

memory/644-38-0x00000000725B0000-0x0000000072D60000-memory.dmp

memory/1508-42-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4788-45-0x0000000140000000-0x0000000140135000-memory.dmp

memory/644-44-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/644-41-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/644-49-0x0000000004D60000-0x0000000004D82000-memory.dmp

memory/644-52-0x0000000004E30000-0x0000000004E96000-memory.dmp

memory/4552-51-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/644-60-0x0000000005500000-0x0000000005566000-memory.dmp

memory/3984-71-0x0000000000400000-0x0000000000991000-memory.dmp

memory/644-69-0x0000000005670000-0x00000000059C4000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 cce5cf45ec57e5596cac624ee86ade23
SHA1 2f81eacba782018145ac07b9be85cdc051fbfb66
SHA256 da4eb2c2d2bbe44911e4063171f3f0859c3d4b9fd286eab12c592482b653cadd
SHA512 a517a20a8424947331c74233c2b0495fa994ea03359268ab28ef4638f74085e9997dc44557a84748f79222c17bc02a438ca12178a8c1c6fe918b26f3f88aff6d

memory/3148-76-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/3148-82-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/3148-75-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/1496-83-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/644-85-0x0000000005B30000-0x0000000005B4E000-memory.dmp

memory/4552-70-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3148-89-0x0000000002270000-0x00000000022D0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 e7be1aa1f659f05f40ae2856dc024a09
SHA1 a61c76339142526c395119221bc3be8c71de760f
SHA256 1d7d4181bfb071ae22d9733c19ef11e0015842bce8869d47d67874a9e2a3726d
SHA512 52938318b960932f5b8398e6b20557993d5e1ae7d46d45af7e4c9147cff888b5897890212456127f6567f628088ca073bfdd83b183d2aa8d13b8e15bf51d0fb2

memory/2888-94-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4292-93-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 6c3edae814e6f5fd66d67b15cda10957
SHA1 e7335acef0c82543c9defe24a989012bd8348d03
SHA256 d4b9bbb5c95739963835bc7fbfb4657c2ac649af63337ebb4487f732f7965026
SHA512 eacdf1475ec36d1f18bdf8ba7759344e7ad28fc4c7b030e300cac62396e13ba85c4bdc45d6ef930dd06354c3516cf9a45c3973b3d097763a06c2f4c31bfbbcca

memory/2676-98-0x0000000000510000-0x0000000000570000-memory.dmp

memory/2676-99-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2676-107-0x0000000000510000-0x0000000000570000-memory.dmp

memory/1508-108-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 8a00f6000523b2e5b668016b88c1b4fe
SHA1 be66250f3f6254426b0dcb9e805b8778085a3f54
SHA256 eefcba3e1662ba804ef763af590316f4b66a90347775ef77a5132104f6134a4d
SHA512 ce07f17805616ddeb387a22f91254fa3481d10d637401c2bf1766d74e3b9e6586331585e94252be174c4e5c2d34cd0a08872a73e2ccf87aa80f56e19cd099ad2

memory/644-114-0x00000000725B0000-0x0000000072D60000-memory.dmp

memory/644-116-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/3208-113-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/3208-123-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/3208-118-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3148-91-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/3180-127-0x0000000000520000-0x0000000000587000-memory.dmp

memory/3180-130-0x0000000000400000-0x0000000000497000-memory.dmp

memory/644-128-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/3180-134-0x0000000000520000-0x0000000000587000-memory.dmp

memory/4552-136-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3472-139-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 bb36918ba3594182e04bfba54deac048
SHA1 787f483f2dee5542e23cae9cdd65664675754206
SHA256 8e35e40178c564fb5e32aaea1650b5904a349ce5591af2ca6dac09da6ef0e61d
SHA512 95375e94e16a089f3c810bb89fac2dd20f468d19fff1a71d61ec09548183b64f294915942796cd8cb601a1ed8058144148ade110bea196239cd253e0e15ac76f

memory/4336-157-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2676-161-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 57f0093398d94fec8acb50a2d9ced763
SHA1 a256a65f41cf49d83be87228569977a1654c620f
SHA256 8db2c26f29d79961ef7b0a077dc449040eeecacea3637137a87c68f8fda7426c
SHA512 6ef5c3085390e4060e95129f1b75ac748c5de554dd20e3bcdb2348d76aa01e4f43d2ddb7d539fea4b73e36f8d41bfd9458a18c8bcfcbc3105837636723057f47

memory/4412-166-0x0000000140000000-0x0000000140169000-memory.dmp

memory/644-173-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

memory/644-170-0x0000000007520000-0x0000000007B9A000-memory.dmp

memory/644-178-0x0000000007070000-0x0000000007086000-memory.dmp

memory/644-182-0x0000000006110000-0x000000000611A000-memory.dmp

memory/3856-184-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7376be56d4c5c15a0f74d1ea5a50e86d
SHA1 07c713766255c65abee24726f0869764118188c8
SHA256 2a2aebff5e39748751e6b4ae2d2a0a3adeff0fd1ae93e90400f03102c1f51ad2
SHA512 836276168577884f07143cb5cc3cb34e0859bb9c236a5e13478ec628f6daba74b14323922ec2aff2b27db5f58598c1b6ccb6691435ebb446a07dfd733a7acfa2

memory/644-191-0x0000000007100000-0x0000000007126000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 ff528fa99067a5f21bf93f92b3169613
SHA1 c4f2803bf14a44cc36a8d3b1d40309943f0ddf3f
SHA256 0c24a906791c7552ddd8ce08f919d6bdbbcb708d81f6671b6a0ce91fe90fff20
SHA512 a30e0e1fa9992f1762f0cd0af7d6b34817eb9831a7684467ae5872e4bf3ebb2d2e573054d5f7aa4fe349934e01e7db38f60465807f280096bdfcc4d292b09bd3

memory/1224-198-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 38406723dd201e72eaeac1a3df285681
SHA1 301fb740b481711d450b64b5a7dfc12d205d35c2
SHA256 228ff77c773e66d95a85a3849432320a39b5bf361eba5e679f145e00be65b010
SHA512 f04cfec65b5ebfdd1c78f192cf642d31909e84ace5b7b0280c49f2ce869ff9c7c95f5988311ea687cc678cda12a89b3fc371a7af68d24974ca68a8ca7db1c2ba

memory/1348-202-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/644-204-0x000000007EEE0000-0x000000007EEF0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 ebbf2a37cfc4e93cd0540e5ee5ad3b6d
SHA1 50a017fd63d0f039afd2ff499df7753acb7b6624
SHA256 c08f9acb237d05658eafee69661b9bf597fabeb4ca4fdf7f0a2c68c9f06f0769
SHA512 e90f70ad39d49f93ee45cba6a4d283d1c280fa0e30b17a04f1bdea9fce1d4a9fe359b33613159bd9eb4677cc4616f0b4bb36878d075c2fc4ab0748c0e5158f77

memory/644-208-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/4392-209-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch

MD5 bd3457e50947d4280734e74b51b5b68d
SHA1 424635c6b5622a6c01a59d290a1c9ab8e593effc
SHA256 23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5
SHA512 e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 8e71e4787958761031ab6b4d732e8c78
SHA1 3eaa912d63cd63338d614000121c9383169b431f
SHA256 789fc7c82c4c96a4971e97ced3faf2c1c68d67ffdf2ec25c2a1df678046ed2a6
SHA512 d3bfa4c5c12062cd53b5538e4612015ebdb2702215e921b4158e6a487a945ed7fca55c6a90dea674ef04cc66647d9f58fe966907e8a5e6f9d89117b9e619e31d

C:\Windows\System32\SearchIndexer.exe

MD5 22a52f73f8973138e97c5374d2fc4ba1
SHA1 2820c8793f4c71ec8f7a2a5d00353b092860a2d3
SHA256 da3fc5ee8944b2c2798bae523fe4d7c3512056310b07c3d53774c638a75dee96
SHA512 70e4b0f5f3ce7c7951df5d53ea34c23b581ac2550471020361eb62f72f269b507801554114d31d58efb2a7e9edfe69a8cfc3254cc70650c7dc4ff4b674a4c1bd

C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch

MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

memory/644-217-0x00000000725B0000-0x0000000072D60000-memory.dmp

memory/4336-216-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 e5be009d169a7d9586ce49a730e5034a
SHA1 c333cf10bf8fdd681163cf8ef58f907030bd1189
SHA256 b3a0d4604e49d52ddd314d1941d5866edab9472d51545b1d041298bfac648acd
SHA512 012642a13f23f29707ccf46662713c69dc7b03b0bf9d0ca29c1f5fe940ddda22ccdb77894bc848d448684d6f152a158a41a2feabb558baa8d25d708ee215b879

memory/2540-206-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\vds.exe

MD5 e12c65e27190e27d94d0cd7b9a0b9918
SHA1 4511388592d14d1088068752563bd4a28b2bf6a8
SHA256 d5bbdae5c92a3ed97c39c85ff07377f0f017a5f70116483bc6d6cf9ca4b2e3d1
SHA512 444f1196ff6277ad16733e9fc89233c7d47923f50e8c576c1cf5741eaa7ce2a49e52c28459b0b4e76f5c76f52812537b7b8bce8f7558f85fd65282db1bfe0367

memory/1348-200-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OfficeC2R90E2E30B-9350-47A8-9A12-A7100F7C595E\VersionDescriptor.xml

MD5 8dab2f2248f23feea9b09681c00f9849
SHA1 e83d66d05d6108e5633596fe92c161c112424759
SHA256 93b133cc9192a13b1639ab2766375c1c15384fddfe8ef1007af7664097665e48
SHA512 7858aff3bb9ec28620affe9a14f524cd12b009c6c679d498542005426ac91f56a6cd3debe2b7084769b017bec48996e99b014b3933ad434cf7444d1761759fad

C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32_16.0.17126.20132.cab

MD5 9c9b0d6f9f47234fff9513a0ca80b9cb
SHA1 6180c38af7986069ca79f40255c759a421a20dc7
SHA256 280b1a03e596eb36d9699725dd8f63dba958c1c9ce715651874732926ab5451f
SHA512 a62e1be095d0c6fff465c87a40c87767fb7276fe0fa09bbbf1204fc01af4dd4774cd8eb8a57390cc507fb53eae1e3b1ed8fecfb9c5dc7cf2dc0ee4240cdf3413

memory/3856-194-0x0000000000D70000-0x0000000000DD0000-memory.dmp

memory/3180-192-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 270fa722cdae23bc47fe13836ed17248
SHA1 9e2b66775277835e60d551f431af892d0a618ec9
SHA256 4846a0daa72c2a94c28573f9d741d5ade64651dfa679e48e3e057461bb749fcd
SHA512 2336906433bebcd9ada89e61226cc16b7a50d288b1bcd17e5bf29d433804db1be2c467a75076f18249955510235e52b895b2e092115c382370b2db6ba0992d90

memory/4412-177-0x00000000004E0000-0x0000000000540000-memory.dmp

memory/3208-176-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/320-162-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 f5cfde6e0343fea063bba74166b86737
SHA1 1250ae38065ad08a4b359f7fe6fe3b62d8004f77
SHA256 301ba6f7770b5782ac3e83bc27f8b5b7e7bac730be423d21915c344c6ac77ed1
SHA512 1cccb78619ef7476a402106f7ac259488d133355fcc91b9b748e032114f57ca1c603015a69c8ecc2dcec68e2ea891063fee4bf0687bc4c0c1a4a9594d0148041

memory/644-156-0x0000000006DF0000-0x0000000006E93000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 e8431e306345449fc69da6c63861850f
SHA1 3e80d6ad5e7bfa251e87e90a3659dcd16367809d
SHA256 871a4d9ae970710f407b4f47d08bc985bbdbeb27eccf3bee47175da5112fb74f
SHA512 6732be78bbb0474a1087caefd9e4acfb25e5f7d80947e81c908e51ed58752a57e59f9cc43d024d6b8f4d19b00d769258fa846809934d948f2c83bd06ec1382b8

memory/644-154-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/644-153-0x0000000006100000-0x000000000611E000-memory.dmp

memory/644-143-0x000000006EBE0000-0x000000006EC2C000-memory.dmp

memory/644-142-0x0000000006B00000-0x0000000006B32000-memory.dmp

memory/644-141-0x000000007EEE0000-0x000000007EEF0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 a0143e27c8412c5143f7ae423f95c7eb
SHA1 d2fb08dc8914b1b01ef4b1f14edd874b185ad7e3
SHA256 f92d3ee2c0225da99d9cf763ff4454e6c82d19a0bdc2cec98c33807241ad8b7e
SHA512 de33fc52682f0382bfe4e05108d9bdc1846387d8c7f503e6118530ed62c957e7be4906f66828a66db614810f7a97694e0b8f02e5f2091308fdf4e8b9a1da2fdf

memory/644-88-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

memory/4552-58-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cw2r1qe1.jh5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 f91102ecf113189dbf076aad48476e3f
SHA1 ce055cd980e7b7b07eea0dac4ec18d5caa8a7f41
SHA256 660d2e53310ff3ade73974fe8bd2a8bc30c883219a4a816ee5bf2c35a3f9d12f
SHA512 09e2063041ed7210a9e5ff1702aa6ac51b10c690c48c031690543dbce4a58c66ac82f8d47e1d414c2bfb459d9f108996d7c7d8eece22f015fe7f41c021ea7462

C:\Windows\system32\AppVClient.exe

MD5 d3254a7155443a68db82491679b2391d
SHA1 d6806f6a1ac5133e5d905de3bfd06e48aaba77f8
SHA256 77606c8bee61df157a826598b083c747c4c58ecbacee2fe67654108cd8004051
SHA512 1f0132e33c2e7e539a684421d4c291e386051fe290a8c61b62ba6890521c916f0c3f82876ab2ab6c3d15c2ec62b537960904e94fadb431d711c8ad233ebb9b3a

C:\Windows\system32\SgrmBroker.exe

MD5 39b80e16c92d8eec9c65287f76edf54f
SHA1 7d0843985374b638b95d46c6a61816f31fdc0053
SHA256 c00a4c7730db72fdc1caafd5526320022c229fc69240ce08c437c42cff2e0412
SHA512 fe81933537cb34838cc11fad9bd04957be7d891264cba84d95a012611a14398e3b967d3d8d181b7b41598033a7a93e25aa3f8d370d0c77717aed31fb78482683

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 6d71751aef18076191a29428067cba81
SHA1 b1f3cdc2cf9c345bc6258dad2144010637f0f396
SHA256 d2af27baa592bc8d31304a1d0f4c93a7efff7585f0446a1222059a1fa6eed141
SHA512 a2a4f3415ef9be223ec8a92c827ad42bfd96f5204827542560f22f7a20f698fe4f20e21c0b91bd828d31e6c4ee41bf496d1ce8506d5c840c26086ac6c05d58fc

C:\Windows\system32\AgentService.exe

MD5 da0af0570a3dd6cd5e4e31e694fafca5
SHA1 883f762f62d3e738aba9f17baaa13da7d2668019
SHA256 83ae65376b93604e7fe81089e9cf5701482d8970dfdcddbf3fbfcc092603deeb
SHA512 77a2e910d2411fcd19e3b22ca67bf453054403ce0e2ee0566e0846ec17f1bc73c0faa5242858fdf88055c26000f57ab52c6f5a69fa8e2d9e1a991ae264ec8ddd

C:\Windows\System32\SensorDataService.exe

MD5 892b389a7e0033ff47ec2ffce2142669
SHA1 7bfabc3f759e7e78ce72a2dad999c84eee81bb4e
SHA256 8fd4718637fcae8f9b558e73b2cd7d74bf99dbef2fd4736a0e8bd7695af0cd1b
SHA512 7a7958f650d9b67f759d7d4238d3fea0d9c4666b1eec05e9366a2a8125f895efa7b79630712c54b61e523a5011dc8fbac216e00f297ff9ddcf6f30dd40185aae

C:\Windows\system32\msiexec.exe

MD5 ae98c136450a1c386546fc8feb338756
SHA1 975796024cf2b581e2dedecaf45a0411b533a77c
SHA256 308b6d793ba81c9e468f6ffa76382e5acf84f7b7fa021b73a0ebc597ea976978
SHA512 41892c57120311f10c26df0e47ae0a26439c0380dc0ebafe9e50325189e398ba695f24c718e6e7d71f222f44ca416299be63980751841ec68d00f8a20fcaabfd

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 15ecf2ee3fb48d2bb8ecdae4e8b74fb1
SHA1 0e18f93c4670b3bb3bdaa2676fed8ad3e0a4babe
SHA256 01e92de9b47080524f7b5e3299260d3a2773ec778c636304e4ba57e1aa1e470d
SHA512 eee6b35cd8cc2f67cf76c88d43d00db8016032618a5bc0fbe3f6aa32eb886dfc23c4147a27e81eebbc65169377f9ed4dbae681440b6d108ced50c083a670cfab

C:\Windows\system32\fxssvc.exe

MD5 b5b6be3192e1dff69cf4197900dc458f
SHA1 2c91e7388847983337df389f2e76fc67dcc030dc
SHA256 0ac666c1fe185774ca85ff7906435a1a1fca79fb58cd8615060b81c065063024
SHA512 12124a99a5a5262a4db6cba8765c63ade884ab792bdedab1090e1f79d672fa39462c279c650cb9a1a096a2029033b5afa582028ec01b05f46fc43fdc9a1f12c5

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d82876d584dead099889f9af92a14f5b
SHA1 d1034b9da66933a8b4673557edfa3948cebfc6f2
SHA256 e1a3bbe49990da443b36012290e29ebdf1f09479f80accc6670c95ae6679db96
SHA512 62c6eb6ba73f3bce03b2bba14e0c0cf1d0b617749d568ed40c7db9d344c9e2fd029d7f3c6ba118beae5a6f250735005dab1e123f44bdb88ee1d547a73051031b

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 a9620f22110b96cd2b42a4ed61b8485b
SHA1 fa6535428c69e4ad37659acc4e86254d9cd00920
SHA256 224021ad7c1f8d77bc5769ee5aa642cc727d486536bdf6af8f3684976e62d99a
SHA512 a55ebc933e5307e2f530e18837e7d131b6e11c5c66f56ffc59bb697a6083bbbfbf98db46f538aabf7dbb081e21e3e44be0a22bad231e6b6dfe6bc47ad8afacb4

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c602d4f3e9e7aee0d487624bccbeef7a
SHA1 2ea9f81298580d548a0a4cf2c04bdaa6a5c5602b
SHA256 94270a180c35f4e2b1196dce677251278a31ebbc716d255abb02176a74062be2
SHA512 95769a2a4f77d75ff0299e42527144e30530372172730d9e2b3ad62b597b39e31a40ad5f3c82b9c8d7897948ef7a44e6bb76cd259f9be92d53a37c90f0d1b0d8

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 fc4ab24bcdb4c4df4fc6df0e9a94cfc8
SHA1 c2c7b602aaa85e2c780998de05d93a580ff959a9
SHA256 5e0ec90b5f579fdeec7416bf5d6860c84687dca00edfaef867c4c4f9a1d04505
SHA512 c13ee87de397912f47982c478ca898f70305886ffc7f08c820f6ae8c5e7b2b26a4bec13e6edb490e6d585e4a4d3535fb9cf32573f86669073988f0f99046bec6

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 cca6b64fc4b59365799268b59255fc3d
SHA1 7793f2133d70ad8a2baceb684cab3b291863c918
SHA256 aea704004c025d04d5b6885a7f7d001fcff5a14bbb5201473b30b0b83216223c
SHA512 2b0cbd8c2db3d063d5a255eb7ab635b52d53e45f414d0ea268a6e7dfcb5d445365ef94df30583c4a568e698c341519e36e62d03e20febef964494c77f775eb4d

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 4865dab4215f532b5e21e08335a7ff73
SHA1 1c00e3bc2f7a2daf6f467e07bf0a88060574c32a
SHA256 09ad02af346e6d3c00592446af14b67742aa461613027edf8fa5a8ecff9786d3
SHA512 57f170f4fde1ca64afa26048aa94ecf8add4fc13c706090fc0c69a408a59fd6e6b08d9e75ccdfa18494c94a27515b15ae5837322ec1bd249534830f2e2a5b197

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 9a18211360c5a86a485bba610dba3ad7
SHA1 b4479932353fbd6b9edc85f6960580a69e0b4926
SHA256 08ac7dacb526bf4940c90a821935ce28f5fe7a5bad4b5afa806612b58c8599a1
SHA512 25644565ed7842ad8c507bef87f189d467ccbd9e5ce66f29c086370b2152aeeb95696b30b7d5701f1e34051054c5f6f326ecb5623841d0218ab09f9c2386c0fc

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 1209d8cdd3590f334563a7ce0c9094c6
SHA1 5aaef9a47598a75a52f0bb5e19e98d9ade907d5d
SHA256 b529b8a4312cfa40d2faffdf5a00bc35777e98267433dc7e4241bfac3be55101
SHA512 1a0d9c518763fd2f3b3298c880d6b0ce4552d921fdbb68637b8047f003a5c367731fba8a76f7e12dd7994f192295928b1c67e482d22438850e82c0b5d0a66394

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 3cfe93237b833f7b3cf06c1694411921
SHA1 538571bf8393b6081f2f8c7a1ea266dae7d1e748
SHA256 a06e0aee0bff19215fa2416aceb089cf757070378fd5db677685e3b647fcbcea
SHA512 c873146cea12a82ee3d1f249ae1943938dbfd38012a11e6aeba6cdfdf57b9d4b2ab6c0d412a0cefeedf86420c0fb0fe600a2260ab872e2565890f36a3d3d924c

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 2d3352747b60d688eb92af24e15ab882
SHA1 c4be3f43b562197f9bef7859bb3ae1f5412cb779
SHA256 175c9bfe436f15e36025b3de35acb8e783b0a9404790caaac27cfaa385cde478
SHA512 fab3b5effa01cea8adf272eb14dfe5a8c6419cf9ac00cd6c608ef3c5c28a15a1887d97c8c24b9667fbee305973dd698c90c8626673d284fcab7c4007c9f8f597

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 62b5c25b9618f4d6797a20022c7205d5
SHA1 3d62ba2d4d38c127670bb1253aafad3fd4781d07
SHA256 5f881ccc54a6076fd8289c6611cd9150f830b1e95d3ed4eca12510d0ec0a1624
SHA512 724a37e04a1ebaf5ada38fbd33a4c6b4612a3fd2904dbc93b283bf745a6b6629ea0ec0da701ec769c7937e50b8fa9a0166cecf42c50c7b29864ae7e6f7f60e8c

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 44a819229bbccbb0bc13e4f9cbbfb212
SHA1 dcb3fa6f210905f50555a47552d331c5b8a1d4b4
SHA256 83f9f153ee78b5e5853910dfc9d95c2c199159b6b4e635f10eb02e51ac3e9545
SHA512 ca1e05b08821e97c79920f4d07bfe332d2ab4858def3338a8370ce27d2a423552be0fb19867a51d7e98b991105ef49a8d4fd3f46ebed9d099d105d397f119191

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 6d3daaa86e2d05bca24af4b5d554273f
SHA1 27b8dfaaff90433bbc84039d377ebde5247e14d0
SHA256 203594c00af8e0b652d3c8c3cd16be32ceefa3c4e499f8f59017926493614a23
SHA512 5a0ed58fce6751aacbc620133e806b9730c73856ad29e883f1015967f598b1e69b94e9212ca2412bfa24ede3eb1c37a94ad5c384569cc8bccf08290a1165632f

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 5ada93c546ca8c0f778607f23584cf8c
SHA1 538dd0d9d54a689e38e0a62ee7a293d5fcc8e13e
SHA256 5f4e4780f2282e2531d7eee4b17caf4d308830a9cebc5adaf3c50f2e765df454
SHA512 297bc9692659ad14573c34cdf63597f6d3a374b53a6de757c0cfce65719f295c9b0253ae4425265a440d5706ac4cbdf0b649ef827b0b904bc79a76081507ff47

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 56cbc7208ed796b6fc3a9e8422eb59c2
SHA1 5615bd34c6e03adadaacab3c0c6ae94fdcc1dfa7
SHA256 18ff699a1782496ef5b70b2a355bea136b7db86a12624b6d5ba442aa37f84d12
SHA512 1d29cf4facbf7676eb609babd702273a32fb40372eab16f053d0538ed5a9fb6313b248c14d651536fcac2f4ac9aa84b0d2abdb112335ff1405c2cc1556d15b60

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 60b9bfc745416226c6f2073ef730f320
SHA1 ca663ed4480e24382e809d0396e9f2ff635ee18c
SHA256 b19a7fbffa4634db3f4dce6f8df06d113231a5b4578a2391de25b2fb87b878ac
SHA512 548bbfde20bdbad4bc375f555a0282b8cbcbd58ddeebc050c433d8997a7e2cc186a259af17deb18ded58510a7829b2caae11699e004529ceea2d62de8dba7c35

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 0a3f98d2a9cba257e66750254e12c824
SHA1 9212d8d2d077e407b1f551ee3c1e91abe6a6b71b
SHA256 f37fc4258e214cec83c8fe00f231851e7f74e58cebb1ea00d1a0038cb7cd7d08
SHA512 f27becfe743766ee98578b8306a9bf71864eff2e291e55021001f25840d626db1446b7f1e3e7e6635b6266b5495615c7dc02e08708d1021da82b0ee70dc15a97

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 68da5299e2228a0b678a0a985ec05ac9
SHA1 c1bdca22a0bb08bc26e5ad9fecf588fe63e27886
SHA256 10d310b316fb1b1f29802a7f752aba9f224e3c9f6a08c55517a45c89db3498f5
SHA512 1a3dff35b0b586b2e2ffb0b3907f4da5a2797e9c184c8ccd751ad859a2b25dc5d487921f753a6248fbc9b1e965109cb3b012ac5eb3f1c36d92c051d3018311ce

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 7cc21bcea9ec1cb5a704fbc9868d36a9
SHA1 534144febbd5a1b712da55e3d756b28023bf7da2
SHA256 05c151a3e38dbd832c67198ab0801895b93b5e497089b4252260f7dc5c4a1e63
SHA512 5688eca1cd2273db0a0934bb21fc9bbec62956b03865e6c081861a760804e450ff1baf77d9dee2ccc3d0988e4031effaedfdb25b3effce6b620e588518eca056

C:\Program Files\dotnet\dotnet.exe

MD5 ee0403b3d1efbb1b7860aeaec7000169
SHA1 40096c1a5fadb3419d0a4da1e5f8503944c22803
SHA256 438a9b12f6fdd2689c56f94c2affb91b05a7ef12ace68d2a7bf11a85bd5292aa
SHA512 483a34ee041f24ff86d9510fab06db15bdb18581c621d537c98562ad02a61ff0d4cbf54e7f68567d500d2bd57ea31ca04a41ccb22c4d99c4822e2a51a58c0fc9

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 7e66cb9b2ecac0dea0e3baa18ae0de8d
SHA1 7dc3e194cab3b5a20b73e59433e4a70cbf4948a1
SHA256 d0eab74d46a3951b6be249fbc040fcd15f06168eae29fcdd6bfd6e810c0623df
SHA512 8334cba1bab06661715ef25fe273bdf7aca6c807a0b5a267a0cae29d5b1efa8dd5483283f58c9e05e50f33fa28af2d33ffadb2fe5158e6aedfc76e969061010c

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 214d20efc1b25f1518b490e01490a081
SHA1 68f0f27fbdaba29c3ec63752de7a0c12a890df90
SHA256 5a843b62106769da4c63105dea65a6ce6825ab918b749eb4ae27708b2381272e
SHA512 88e493b588c0071eab03f8827e232162130fac6871ad9c785d77a12ff55f236b0abe15c51d363bdbde905ac8c6eb31815856933ff5b497c59e628c7c37e15748

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 3ea420ff704a4ad1b2975004f9889933
SHA1 36ce331483551c7daa92bb1c438b13ffaa8fd607
SHA256 16c41efe862af6ee4fda8fea5d9839ff7ca49f6e17c43d0fa898b49ea3502aff
SHA512 3765f451aaf53e895b44651885606066a62c180515374f343b6cffe7d6ea5d795628375efe1b3775ef90ac7a48f573e41fb274002ca2a5b8ac3b1abf508a0283

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 09e5ba6a95525f0531bb4ff280773282
SHA1 de35d7daa3367f6e34733742d61c6fd80caa6b87
SHA256 87fde58811f00799287588bfc4e6c47295245227a179bd7c4f43fc0d66240043
SHA512 a5565e70ff71e7e9a61c7d60d03bb7fea339bb566f009eab2144e2638c84826069dd061405b423c992171cb59af03b612afc782897357677cabfe23483884abc

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 429a6d516b20829bb993a42f3269ea04
SHA1 781b9b8d9b61db2391cc5ae13e6842b11f50ee39
SHA256 a40d0ec53eeeaed52083e525588a82c0d3197e5e7aca9f3c1c189eb2f7b286ac
SHA512 51d428b753083383c054ace7e980015cbccb2650973d0b4014a335761e6b1e3695324e409eba7cc2f17073fa287df7512c1eb50f04ef22dcda99c6bf89249292

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 237279c06832a256fbf6c3bc1b8e5a17
SHA1 9c9cd75355565a81bf03daae3d9ee280cf6ed909
SHA256 6b052beacdce530184e6243141f3d219b6ec3ddaf5d0defee25dea06f56d63db
SHA512 a19fd198de2181196e69ac1cdbd50bdc6c1bf7285c3db693c7a3c078135bdc38571317d6abf49695f3439c60ffe96e4c696d3d2421977af75af794e411e17a8c

C:\Program Files\7-Zip\Uninstall.exe

MD5 5fb61d641cae0309c29db5a5a089c100
SHA1 a198e05036891ba96acd46ef3e39de8bc607f538
SHA256 b1c8a9b44825ba18f76c473014330f0920c8415c8b5ad3d10e8c092072c64c10
SHA512 add43a5db82422016836370605d3d768528fdf953b75894e7469d1f76545443998b4dcfe7c632f499d731e1545b6226cccf773859462d4bde10096312e23f94d

C:\Program Files\7-Zip\7zG.exe

MD5 33da71ec239cd9b74c4ac99322263707
SHA1 9d7e70e2196780f6832e09765d634b95e45df5e4
SHA256 ed8e9204773c07e6058077256461996106e1992e83ab6becacdca2d83bed2350
SHA512 6249b6b579aff481175654d22dd81b01b0b2a718478058be22225b8490a3610988eb1b4ed1530ca60fe42b8dc30bacb94596e3ed624b475bf8667dbd09ddecd8

C:\Program Files\7-Zip\7zFM.exe

MD5 c5f567699f15b387a78f17a1d48aaa37
SHA1 572a896bda5a4c710938ff624589d5674cc3338a
SHA256 79ee1a98d18c6ff6b3dfb4638ce347c47f9e142ecd221579bafbffb65154b1a4
SHA512 feb99208fb87c203c18001d985d5551842fc7cb29317be685ce59bc3b6dffa0316ad6cd568c6c80b180d1bfe5e8ff301c2e57916bf1e4bcd96dc378de8d0d4af

C:\Program Files\7-Zip\7z.exe

MD5 5a9d7fdf3168a07a2f93266a8db629ac
SHA1 f47d5af69a63820f5faaf7956ba9b5a0753ef4e2
SHA256 4ec79a54347718cd298fb37d8d7b41d965d8e530fea98a7559592c8aadd9a7aa
SHA512 d502e0fae821e81cbecf6799efab14d3908cf6583b6777a1533e11cfe7a262ca05a50418f10b213bde9467b6cc8e774a921742202fa28e48e15d32db8402647f

C:\odt\office2016setup.exe

MD5 c5ffd1d0ccbd75f19f4944523eeaaa5f
SHA1 15e04ece5b06ccdc5ad1240de742f3384f4f2996
SHA256 904cff3b5aa48434a0320767cd9897aa6b5a46e9006fa7220236e722d53eb13d
SHA512 5420a1f15779116f57b91d962cee7fdd5ab4b2f0f15402ef6815a086abf52f8ac7153df417787169ea619b9c7ad68494a31f76e7d16bb14a284cabf1150d914a