Malware Analysis Report

2025-08-05 10:00

Sample ID 240403-x8vp7sae3w
Target 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz
SHA256 57c77203d652e29271161fa8a32d47ac569d548c731105e73971df36e0885170
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

57c77203d652e29271161fa8a32d47ac569d548c731105e73971df36e0885170

Threat Level: Shows suspicious behavior

The file 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 19:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 19:31

Reported

2024-04-03 19:34

Platform

win7-20240221-en

Max time kernel

2s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cc2a43e62a37835d.bin C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 1f0 -NGENProcess 24c -Pipe 1a8 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1e8 -NGENProcess 184 -Pipe 1f0 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 esuzf.biz udp
US 8.8.8.8:53 vyome.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 8.8.8.8:53 hehckyov.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp

Files

memory/2020-0-0x0000000003890000-0x00000000038F7000-memory.dmp

memory/2020-5-0x0000000000400000-0x0000000001EFA000-memory.dmp

memory/2020-7-0x0000000003890000-0x00000000038F7000-memory.dmp

\Windows\System32\alg.exe

MD5 79b9a92d156387a6f111ddc94d556b89
SHA1 90e3bdaa88aab7c4541f77c5599fbfd8fb78d9de
SHA256 60ef11293d2b1b1a182cee1edb64527d40c5858e74c9a7cd5e9105946a2be0d7
SHA512 fc2da9efcea87a13ecf685c331c0f8b7e5a8deed3f3da94d0325b94d8b0956363e583be2c9d5dee7df6a49b2c6f83055faea7635196796a7b5384d0aa0aebe02

memory/2124-14-0x0000000100000000-0x00000001000A4000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 0144e876a3f6d9f796da0105a931383f
SHA1 00c57073af96a31b7bb5f2a41e7bdeb76277cce0
SHA256 313d5d49790ad028fc66d6b3544358b19be14ac7560d914c650950bf202b3369
SHA512 2bd73c41bb2931a30a2d4ace46f9da488578b73133154ad96326cd93a0a98e7b8eb094f98e3d479362a6ea6f7274318dbcbd95a91bb62e02cf3c726aa34af395

memory/2808-17-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2808-18-0x0000000000410000-0x0000000000470000-memory.dmp

memory/2808-24-0x0000000000410000-0x0000000000470000-memory.dmp

memory/2700-29-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 e7154bf33839ce7ac15f3689767764ca
SHA1 af2edfb9a198aed44d8c5109344fe183ce6621a2
SHA256 e2dab1c5a3dfce7346cab71792c389eb1e26ffb89c1574e7647522459ccef952
SHA512 255c8185962670ac08b05a671c792e3c17482d3d05ee8644ab3f52b244ce2d8eb5bc64025fe04903aa968e1506a3f1913c35a72dddb968f41ba19e1f977e31d4

memory/2700-35-0x0000000000A00000-0x0000000000A67000-memory.dmp

memory/2700-30-0x0000000000A00000-0x0000000000A67000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 51565a9c5457fbe4254e2338b3e03bc1
SHA1 d5c28f47da34291d81186a552bf35a1d006e08ca
SHA256 3483c00e1705c0dda36a495ddbf1aa12a881ea70cc51e9bd040b59d2119da5e5
SHA512 e74025fed1934ec4f34971e7f5a9243ec147ca8d75f4a894e8f3ae9cb688cda57c8a153098243e8592f398470122954da4e42fcfd29e23859e761f345aecd819

memory/2476-46-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2476-45-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2476-52-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 aaf886f9c1ce3a84d4fb8047fe67334e
SHA1 cb0a9e7f516fdf9fd3a67159a676582815d5a18f
SHA256 4814404ebd2affa72cfa9c5a7e2111a9b6ae97219bf2eb39bcb9f57eada0058b
SHA512 d333a0c4789550fc329794d360c4f5df767478535508555d75bad87391708dd43122d6fc378398c3a26e2f4c542a6437a3767acdb4659d7665e1742b8b58e638

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 9e48270ee52bf713c0f93ef87baa3cc5
SHA1 76798c9697424d3182dd5cba04caa971a2bede2f
SHA256 3ec6c640ccc4aff9baa49a83546039a9bcc72cc1e618197a30c2ea50aaeb2602
SHA512 413d81624146e952d081b5d970cfd28da714341a5f1e8d1fa8cb3411671d6a85837cd4c697a5700739042ce739bcd1a4e7e45d4c0e7ad9cb217da88967736dce

memory/2700-65-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 cda7e491e8597ac26c112b16c1a09d0d
SHA1 9b52dad7f7fe4b2716e3591fa16a6b4e6e5acf80
SHA256 641090001b5bdb67eecc1dc7c89acdd554bf4f1dec7e901d66adb1c8fa79a10c
SHA512 9320c3f3ea6a589834b3da462af77aa714c1098ed16999180951ae71700a9dc73bb7b692bc13662d9dfe401a9ad07e7e547328faae74d39f24401171a16a4a4e

memory/2744-66-0x00000000002B0000-0x0000000000317000-memory.dmp

memory/2020-67-0x0000000000400000-0x0000000001EFA000-memory.dmp

memory/2744-69-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2744-74-0x00000000002B0000-0x0000000000317000-memory.dmp

memory/2744-73-0x00000000002B0000-0x0000000000317000-memory.dmp

memory/2476-79-0x0000000010000000-0x00000000100A7000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 d9e3cfe666606fca3d2fbdd3e3e83c98
SHA1 e43dc83587ff619254636875a1ff0e445e51fbf4
SHA256 851cd8ea6fc99ae1a56f96cb658de766e7fecc6c8d6a59c26b1c7a7abc0df67e
SHA512 eb4e14822b1a86c044ff60d7ba8c17d93b568850d9b65f8ebd83d17ac27add93555c60f78a51cc8dbb00ae2aa78e7fa8ae5a68308cd9a0632c1a1779859ac1dd

memory/2196-85-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2196-91-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2124-93-0x0000000100000000-0x00000001000A4000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 0bd871210310ea3f9f83d0b110f367f5
SHA1 727bd921cb04af55ae030f8e527bcec1925c0431
SHA256 bba86357b7d6ea90ba91e3c9dc658bdf1745c49d25cc4747e63bf8157764122b
SHA512 afc58b8680c047eb0a2cfeaa88446b7fbc529e78bd6d316656c1d9d489eed59a340c2e5b7710b59739a383180d1dfd695243f0cc27e15ba7fa5dfc6d40694ed3

memory/2808-103-0x0000000140000000-0x000000014009D000-memory.dmp

memory/276-104-0x0000000140000000-0x000000014013C000-memory.dmp

memory/276-102-0x0000000000AD0000-0x0000000000B30000-memory.dmp

memory/276-111-0x0000000000AD0000-0x0000000000B30000-memory.dmp

memory/276-110-0x0000000000AD0000-0x0000000000B30000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 55b335340acbe47226dc1cdaab5bebc0
SHA1 a8009482cb195ce9b6002e5863c8d7f28b69b5f2
SHA256 0d202afe4f2166b1f793ba6b92aebe342e43c25c162d4774206278cdcb7b2402
SHA512 6bf407fa65c08fc35806fa9168a8c46bdf2d0f16ea12eceb3f12142868e779831a7c9d65649f9e700dbcf63cbd6a4cd0ca5f8fb2ae123f8d5666e48896b6e3aa

memory/1756-117-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/1756-116-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1756-123-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/276-129-0x0000000001A30000-0x0000000001A31000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 fc33acf5d1cab55ab85f535c185e92cd
SHA1 31ba360f63a46363b2430031dd482a20e15c9908
SHA256 9b2974a8d40c854f59328f65808a421c7c819ee8f9d793a0645451e3164c87df
SHA512 15a3bebe1d8088ca7163fe381b09ca97cbb096009bd14d0b91e9d7bbbd87f52874943b880df1f9cfc0effe39a29e3ac0e0aca1d314ff22b9413c958da95bb126

C:\Windows\System32\ieetwcollector.exe

MD5 4870ffcac1f6fd9d45dd37a4920d4cc5
SHA1 fc2a47ef6f4bc4b434d07562ca6de6a980eae79b
SHA256 fed396b5bc83a225763bc237ca67fd6f3f764294f25a46b73beb2a1424ed8b1c
SHA512 3a852e3cdcd498caa13dfccd2f3a19397eddd48ea192ca95d10c86a1dc41fb055595669fdb57714ede6e505dd2dc574ecd88077756a15b5e513e4dd444f6a230

memory/1776-145-0x000007FEF4510000-0x000007FEF4EAD000-memory.dmp

memory/1776-146-0x0000000000C00000-0x0000000000C80000-memory.dmp

memory/1776-147-0x000007FEF4510000-0x000007FEF4EAD000-memory.dmp

memory/2196-148-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1100-150-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/788-141-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/2744-140-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/788-132-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 dadd89b91d753c61ee9c6d8b40e3b05c
SHA1 7a5c94cb9dd209794b16f7d61aaa8ad79d4279d0
SHA256 7cff57126b8235aac997798416f9f67373d3c69f39748a3f63105b14d469552d
SHA512 523d9bfa3ec5e7fe060c5f86928946b3cd65c5e1e944b46777c6f1735ee506142df6f3ee883f188b7bbff2312ecae8eb2ed4ecb426f05a31eedf7ccc9f9e0465

memory/2980-154-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/276-159-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2980-161-0x00000000005F0000-0x0000000000657000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 67b5fca758040984eb0be224fcbe55be
SHA1 f35faaf3a119467cdb73569336e7eaeff490a1f8
SHA256 904c73e637644fab3cd7a1cb4c9a25128605fa3bff86c7e6f28a3eab6a895c82
SHA512 803dbb1e7a4b0ff3e033cc983c2ac4ab54128838ab00f1ff2c76986467edbf2d68921feff484c8681f2d8f1a1812f070e3f3fc0ab67a8a5af88288e68d1bf26b

memory/1064-166-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1776-167-0x0000000000C00000-0x0000000000C80000-memory.dmp

memory/1756-175-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1064-176-0x0000000000FE0000-0x0000000001040000-memory.dmp

memory/1064-182-0x0000000000FE0000-0x0000000001040000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 7c1ef73de9ecda783ff8a423ad2f90d4
SHA1 8a5d913718938c5e800bc6ce8b88b090b18a3bb2
SHA256 a2d7680d1e6a18be04e9067c879023e8918b4866accdfa1d202cd363c56bebce
SHA512 d78531934c6fb567625a5d7cecc29fca106fbdf6e54b131617f288839a4333164db7aa8f46265078c6f33364f5e646400e40c1ee3d1f823325a11ce7fda9b92b

memory/820-185-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/1064-181-0x0000000140000000-0x00000001400CA000-memory.dmp

\Windows\System32\msiexec.exe

MD5 270cf271f31560bb33ca586d4bc536aa
SHA1 37e5fefa5c77665e5e647ae228a181f36cffc60a
SHA256 7fc6683c7469a5ccddf821bc28fd066cb7791b85443a6cc9e5b2a72042147ca0
SHA512 3fe0eb9cb069fe8dc363d3a8e93afbf7a4892b13fbee3e366cf6ab9ff094401ab0f64455be6bfe96fd00167d273c96731bb0f7c2c494648cfb1d4bbc729a0ec9

memory/1228-193-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/788-194-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f68a7fc906d6093ec459ebd1675c47b9
SHA1 8973a0767b4536057327b3a09c429cdee5fd402c
SHA256 ca9eda5e0511b42b7396b97bdf9ee74508cc0f84079b2dba2dfd66b2cd70a388
SHA512 73976c369ac909e95cdc32df110fae14234c1bc74d9de87bb79e781df29bde0f3613f34141b3ea6a9e21478f4e687ae293a32a5fb570bfc70cacfc8c3876153e

memory/2564-201-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/1228-196-0x00000000005C0000-0x0000000000672000-memory.dmp

memory/1776-209-0x000007FEF4510000-0x000007FEF4EAD000-memory.dmp

memory/1776-210-0x0000000000C00000-0x0000000000C80000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 889bcfc3b5bd687f849f64ddc1ce6099
SHA1 a75af82dc38f882a2554811de2346b693188636b
SHA256 ae4f6ab3e25d0c21f2fb327dd92484aec9e144a28828ffbdfedeacdb6622161b
SHA512 e17d384a0220fb3e248007841e281c7609632b80dc719c17be1d136e347f045c0d196e166cf292b0954b9f78f66f7dea8f2d3eeecedf69a06bcaa8a53e45bcac

memory/2564-214-0x0000000000550000-0x00000000005B7000-memory.dmp

memory/2620-216-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2980-226-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2620-227-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 e3dde1b9b65dfbdcf62da999be2fc857
SHA1 0275b55abf2b7766ccd3b52f2c67b134441ee6d2
SHA256 437bd7cf602ab432573474ddc0c2124372bef733a59f0f4d1d8c054607214bfb
SHA512 c9d050a278945164cced026027f6fcdb03c9b889fa546fc437486062b3e1967a89b2cd59cd6292d5af3992a047d451580f0f632222920fbe6d4995f319851a4e

memory/2620-232-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1776-234-0x0000000000C00000-0x0000000000C80000-memory.dmp

memory/2420-229-0x0000000001000000-0x0000000001096000-memory.dmp

memory/1776-237-0x0000000000C00000-0x0000000000C80000-memory.dmp

memory/2620-254-0x0000000073EC8000-0x0000000073EDD000-memory.dmp

memory/1228-253-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/820-252-0x0000000140000000-0x00000001400B6000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 409fbee854848c28df1daeb536beea33
SHA1 526bf66021d748690f33dfd1f0c9722e4e3f0d4d
SHA256 1374aba08590130cacecd3848ce361373e2221e14385fcfa3aefc9197ef1369b
SHA512 d598596e8f4a4af60f666a379eecd71b2a901a41e8869c4b9a307ff14d15e5f0c8461dca1ea25ad3d3416dd3ba8e78fe8f12e8664e958e72bdedfee24bb0c8cd

memory/836-258-0x0000000100000000-0x0000000100096000-memory.dmp

memory/2900-251-0x0000000100000000-0x0000000100095000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 c66dc71ea817f0d9235e5c02ed6f3fca
SHA1 3c383fd966fe321bbdce3168b529da597b50d4ec
SHA256 47691ed87cf6a81314eca63f063a86dd8073cf7e2b60a9c7d8a2814a70fb5464
SHA512 43a320806b5e80c5efbfde26f40107408473a45e502cc43da97233c4be54247f23af3b374dd1a56264569b6fde77d8fd21d528add13a69cb6c377dab9a84b759

memory/1328-261-0x0000000100000000-0x0000000100114000-memory.dmp

memory/1228-260-0x00000000005C0000-0x0000000000672000-memory.dmp

C:\Windows\System32\vds.exe

MD5 634a133bf3c61d71421c7736bccb81ba
SHA1 ccad5933a170a700dcdd005d04d93036983d13b5
SHA256 9fcbabc6dc30671c93668eb08ced6def5e12469083568c6bf1f5b711a620b176
SHA512 860bcaac6e44e2825f2caa57fdded11ff2b3b241c99c4a402bc353d4b9e0bba1f7df3e506abe367d86f50443f581c01236efa0e81ecf57304b0b7059de0ae946

memory/2564-264-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/1508-269-0x0000000100000000-0x0000000100219000-memory.dmp

memory/1948-271-0x0000000100000000-0x0000000100202000-memory.dmp

memory/1492-274-0x0000000100000000-0x00000001000C4000-memory.dmp

memory/2420-279-0x0000000001000000-0x0000000001096000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 f925aa79923f3bd75e8a7a1555833f0b
SHA1 e507cb586d3988f6f170575622ddfb9260c457ba
SHA256 7790c70e31a74b8d972a15afee3e55976e44074cf2a7b62eb6ec52a84b7bffd0
SHA512 041df7a5cf4e60b49f91f7492608806b5bb3983650b37710c5df21ef6a36ac951493b965a58d987bd29f42eecbe9dd50785749bc8ecba720f26d532d19293b83

C:\Windows\System32\SearchIndexer.exe

MD5 2a722c274c9fe20f7a6c785d48f9ac6e
SHA1 67735f847add3b80257e393d50c2ba1effce01cb
SHA256 72cbeb5f6ddecce1606f70e199d7e96a4a786d0428cf00e12337543e2023d5c6
SHA512 0c276b8965d8e09591762845262f46280f741134bc3692d74d659b315cbd7c46ff2d84bf462eeb4b98ecb86dd93bb8473ba0036541893d8a1efc0f5b493d785a

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 e1de3ea7d875439b0a4d0cc7ab83aa0e
SHA1 9cdabfe2f72b410eb7b7cc1772aa3c001c3e7cec
SHA256 26a0a53b9b2fbaa3d0a8796a9da6fab96a5c81b962895de037d62733189a3af2
SHA512 5060765a46f7707b258155f73a07caf1603578b98568d575ccc40781e1b68b6f750c3793878054289daad87a74be37f62783643ff226b02172ca02fed1a81bbc

C:\Windows\System32\wbengine.exe

MD5 2cca33842f69b62b48bb482c697183fb
SHA1 1a00582676b8db9bf4d0ba5f0aa7e7d4ce2e3607
SHA256 c9c7955dda7cb18b1999fd0cf6be0c269d6fb01f6f75ad8d9d27aa1997a7d77d
SHA512 e1aed4fd225086cec719476b0626fc740255d4362e313a0aa75f0159e9bc8b18489f12fe4c2841dde5bc6ecf23a233a30e8ebc5edef886caaaf6d958b6b4ed32

memory/2620-266-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 01c568622039e1b1175840c63f070816
SHA1 3cacae9a5bbce0bb49188a0160e11284495817e2
SHA256 21c3a901dba71f0c7328574cff8e9a11d205ad0824963eaafdca9ccab6789dd0
SHA512 86297084bba17a0aaedd178df279eeaab8dc989f2366671dc2ce48a5a3a39e93bdbe6d4d3358fdf71c5cc0d1dc91d5838f307ecd60f2c83040cc0b907c6d9b2b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/2420-238-0x0000000000440000-0x00000000004A7000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 3c2519368705f6724767c3375afc259b
SHA1 b797199a6e871619684c1d9db6e5ffaf9a60868d
SHA256 19363ff1ae7328e34e34aa31c08a5a3aaf23748a709178a5117c36d89ef1f580
SHA512 5ae3947bd1672db8654267cb14e8a13d9bd72e9863e8adf58b33cae620c66b80d023c9267c63e9c5f680e5067de5b07981b33db9dd3269732c8b95cf1ffcdb4d

C:\Program Files\7-Zip\Uninstall.exe

MD5 db72ec4298088172197e2c51c962dd92
SHA1 b4bafc217beb65b36a8bd2892309695e897cdf70
SHA256 98340e5432da268c22966ac93ee8d3fefa7d1b9fd4c1e001759501b22475984d
SHA512 3a864e36a74a1cf6a30dcac47a980d0dfbd111a96effaf4a9ed304623a62849aa565e7a99ebdea857b82190a62773bdd1f735c6cb292aea78a97d19b4fd43d43

C:\Program Files\7-Zip\7zG.exe

MD5 c0fbef16e8677b48baa54e61d3669250
SHA1 40a337d24b554bf760f2162c1c5bc00758b4986a
SHA256 615333253c6c5210e52486112ab9d1ab14daa2d4ee8451b9b24b211231fe86fa
SHA512 9da478405878464b0d9a199f600fd384c449333889bd65f442c0546e96e94f2ed6e61ef54005b4d52afe31a296cda0381ff95bc1f6b11d9728d10f476cb1dfc8

C:\Program Files\7-Zip\7zFM.exe

MD5 05ebfa53971857fae39ee09cd8b6d492
SHA1 f3cb096f6a9e79a559df7744bc94bfd1eec9f18d
SHA256 3153af1c31dc6ee4471b3a363c894298a8057764e880e97c1d57858b7f377c61
SHA512 89e132fe9299b95e08a384589b09c10767a1eba90d2cf983ca0f064b0fa041d918291a012af8bed3179209df3d28706e335957a5beb22f9d2feecf682928f118

C:\Program Files\7-Zip\7z.exe

MD5 ef0d212137bc35d94782d7e365acb8b0
SHA1 e57bc921a55807ba2024cd84d2e57f6e7d5d07b9
SHA256 5f313d2bfe7664235da0101223f6d66bb9663a759f3440489fc9b2107094b1ee
SHA512 3d114af1bc3c7b1ec46372d1e832142df8ce3e0dc689319dc0acf6f2014900b33ffcaf75abb6919961ed7fc151110e930c84b18dce93cc876455ae91fc96ff8d

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 1806260fdaa2076e5130c226379dfc26
SHA1 f3e1650d3e0539a75ace990d12c82f449c9dd8c5
SHA256 d1c0fcc2771336ad0afd5673c414ff395dd09810a21ad7ae8a54a4a40b07bf6e
SHA512 1354ea3533bb54bf6e3c86eec3aaeca042c99add97f10bd76ee9ced395b0f60578d8a2671f13cf55b01a88255f6ec0849f2b6fe382267def3eabcd215fce1534

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 c5ca9cef484e82faec6d6bff7ac3843e
SHA1 2c103f33ae6bfd8c8dd3bb2df20bea1deb8056f2
SHA256 e7e5fd933ff5ae534b1cb7337256a36c614c2cb258318726508cfad30442f5bb
SHA512 a57ec87b999b19d4bc830da67522fa9ff47175c7b6572e7bf064adea18ea49a14dc25352db9e39cde6983fa846932cae91d6a4a84d29c24cb9250dd043527f4a

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 c01b2ae5f085deb4dab8d101406ab998
SHA1 9b676f6e34a57945b20aed0061780ce6cdbf857e
SHA256 48c61e54a44e9f7e8a809b6f3e946263bce10201eaf56cae627d9425246e3a9e
SHA512 11559e2024839f3632aecbee0e7c9eb94722f5803dca1ec382220e33e3918d449e8f6202e45a0c187b9c04dfb49327351d6b64ac4b20b4c60439d29b06c18257

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 bd78d024310dbeb2898e66c391082573
SHA1 a8d8ed42771ca2719e93fc2e9c5446b790d91e32
SHA256 3f3a93aa8f7e6b281afcc002d27cf3596a1c069ec1b4b8e7e56956570e0fc33b
SHA512 f636039a3956faab99d2564cec5686f5394cc32e3f73a66876b777ce951f747a3073632d69c1e381171bcb167680dfa582dca84145ef05eec048768cd9259d14

C:\Windows\system32\fxssvc.exe

MD5 d8a03f90c825d4163329bc9ba077fd9b
SHA1 96b11773d43fa33957daffc9ded128d8c6e982cc
SHA256 18d0fb08709cccc5e8684b0c578c7d6c85ef0f37d098941391df564789a25192
SHA512 7702d9faa3fa0bfc2f671516d33223dca70ff0f7bda8171c74a4fb57df8c46400e35b6e15d80074bb811ea2611daab13a149743313546aafbac1e59e9b696236

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 19:31

Reported

2024-04-03 19:34

Platform

win10v2004-20231215-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a9fa7f568ed1090.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015319fa2fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee357da0fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b9cdca0fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e412ba1fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e3642a2fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020fb81a0fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000aa42da1fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087cfd7a0fd85da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 227.97.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 8.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
US 8.8.8.8:53 yhqqc.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 8.8.8.8:53 zjbpaao.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 whjovd.biz udp
US 8.8.8.8:53 gjogvvpsf.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/4848-0-0x0000000003DA0000-0x0000000003E07000-memory.dmp

memory/4848-2-0x0000000000400000-0x0000000001EFA000-memory.dmp

memory/4848-7-0x0000000003DA0000-0x0000000003E07000-memory.dmp

C:\Windows\System32\alg.exe

MD5 6ff45efa7751e004c01feb5d79ec4a99
SHA1 f0fb6f5293b0feb5444cfc9fa82c34fecda86523
SHA256 13276ce601ded4fd4fae15b94a0c498784e29e38ad3f2d72647d41ee96a23323
SHA512 aaf9a690354163a6458e5ac35a081781b5acb9ce5211efba3ec8ce806b4545a900910005c67a3037bce499479b1c37002681f836e7a8dad9fd277f12a7bf596a

memory/1716-12-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 e70fa66feed9caa784e55e2c41b7861c
SHA1 a7d01cc9f1626059b46d07805bbd292c1d0534ed
SHA256 47b974d9f4fe943334347666765585de0eca6e87f2cdddda121af7ef68726d2b
SHA512 b23b5e8e254113deab09820268e1e831e5d41127c8cb754133cce2b835a58b0915f4bdee942131a429c0983aa8f1de70f0125fb87a40e442a7799c1cc88d03d1

memory/4576-17-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/4576-16-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4576-24-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 481b4ecd82497cb0e8384376b6439063
SHA1 b2866a8296ffad6edd34d203093f12dabc7850d0
SHA256 46f8d062306e6ce745c8518b00159e9e7da7c20e53cfded79e48d93117e207b0
SHA512 ddf54e2665535b0b0bd5f6f91244734fb8ae39dd8954db9c77c86ab000122f0c1b2158f51f5d7e39da8360e7a322cf19d6bd8c80bdbe75c2a9bb412f821438ad

memory/4300-29-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4300-30-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 f492927605e649ce6a8b5a199d26918d
SHA1 dbd3d9b03679e0b80258b86a7a6461d3bf41f6b2
SHA256 b8a317302e8802eede7e745ead581f6d55c8633c9a59eab98c41aeea32860509
SHA512 348738905c6bb38c04ef3b526eba27547241091e8e32ce362c3eddf1e33834cdb222d7bbacdfdbae48cc5d18912272bff31c070426f6691ef73482efa774cea0

memory/2216-34-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2216-33-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/2216-40-0x0000000000D40000-0x0000000000DA0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 fd89f25f14c7e96db6a73700d425c8bd
SHA1 32bff8a31cbd2db98b5fd9faab9e5c43c50ab4dd
SHA256 bdc67ab47e02fddaf2c4b0459e2b4d9a8921f61ff40a74cbfeab40173be74aa9
SHA512 e763ea3ce84ef640a554ecb6ad0d787b155d32b691ba11e32db8196ce44a5479606dd565e9ec31645c2fd7680dd6bd40b0a8c115da3936b22d4e0114ddc108ba

memory/4896-44-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4896-45-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4896-51-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 29286438ad796da542984aa958304be1
SHA1 5d96c923a5b274ba2f0d862d7846822817adc570
SHA256 f976597b4926a7d038d63fd21005d6b502a95e04bfa1e4c7eaeb536ff0f1d39a
SHA512 77685ff2bfa7d41b9a4c028fc9d9a7c6dee4d8fa9fab183c39de55caae6b161f268773045328c0949b07426cbf18a9a0fec26c071c6c73375295b25ba544eea8

memory/3096-55-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4848-58-0x0000000000400000-0x0000000001EFA000-memory.dmp

memory/3096-60-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/3096-63-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/3096-67-0x0000000001A50000-0x0000000001AB0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 f66ee0f1a31c674ed17876ec09a36ae8
SHA1 dfcaf896c0877e1f2604de75be980a63f9f62386
SHA256 9126919ac431442395540626780aeecfcaf0c2f4ecfadce20350e7c3b9a43ef8
SHA512 d29e5577c663d493d2afefb6b4c0c1050241c30ecebf8c6c445ec50393c73a3d45bc438089045376b5795d6263f7155e63701a1af51e13af4d2805fab9ad67ac

memory/3096-70-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1348-72-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1716-71-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 1118cecdf035cf917d5a27c856f2ff36
SHA1 0170f2df375898a96854d13ebe0993579f8ea95d
SHA256 191ff43510211afb59f54342bf2ae6ee06c1694dec63eaa9a219071ba1530c51
SHA512 35b81373e15b170b6c34504ed114d583f0d610f2d6b059af8ac4965e04b3d84a2eb9be66410d1cdf0a13b7058c0e2f5ab55ab393c23f9a2ab7e3c140a360c8e4

memory/4576-76-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3032-77-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3032-78-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/3032-87-0x00000000007D0000-0x0000000000830000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 d9814a73ea5e3e72eef41cdf0b3fc635
SHA1 563226d227c52650019226a9734ade0aec9d4418
SHA256 d48b95a92d3bdd05ac72b292e2566079cd32539ad4bc4e81649efaa4b9cac09f
SHA512 59bd0b09c3a0f32ce50cbac3c04f4f8253d9bc5ae85c0e324e8d6468ac553395942007dc19fc6d30531e7ed06ac4f2eedc4bb0a25ab3e953f5d901b2a371cca2

memory/4760-91-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4760-92-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/4760-98-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/2216-101-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 5ab4caf2f82b4780a43b8ac959bb9457
SHA1 9042fcaa7229918a7aa18f9a8b67381daf6cc384
SHA256 ff181bc7cc3e85a4ce9c56cedae995ce4dd03987b3190824a3176ce2534546e2
SHA512 c925e7d2fd6d83c884890df6159787fcca27e5a20a2b7e9de2fe5cddff021869d27ddbe251ec305ea7b80689c2d3073f17fa484dee9167c5b06635370e454a7a

memory/1764-103-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1764-104-0x0000000000630000-0x0000000000697000-memory.dmp

memory/1764-109-0x0000000000630000-0x0000000000697000-memory.dmp

memory/4896-110-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b3aed7f0163a4ff16bb22cb0e9dd1e91
SHA1 620318d5dc98994af5b2b4290a0244b55acfd5ee
SHA256 943102a9ddb2f177dae7ffbee714061609f18b99db48c313fdcc418bf24dd046
SHA512 dda2776003744cc56d23238ea4266c5a1b99e6af8e19cee1d6894543a2983427a9bbaf42c2e0904cc52ac597ca6452b8c4c41d48ab1995e2b95403b571e9e709

memory/4104-114-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 cec4f34d96939e5bb8f67810ae325faa
SHA1 d228533498c39a7349f6bec0677a67be80aeceed
SHA256 a9eebc84d859034d384e95ac647d027132c6168132afdf5efa99343629c2d167
SHA512 54a7cdbe79e49853d3bb8138b629e24106a5f033fea03a8e05af6c39f49bdf1f21f65ea92e72c5be940b48d006f9861ce1cf8b77596a71eab2cc8498d2f7d301

memory/5036-117-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 61e9ae8fc064db0c0f740aab9980437b
SHA1 31519fba075c2b020fae898e9c8bd066584bb1c8
SHA256 5e80f4266ea4a283d0070f9af957c6ba37c78e98ce412634b5dafb4e2e070eb9
SHA512 f62433b468294b7aa9ba626b40bfb829f4e54986087abbf50f142d5a1a77c794fc2c542d26cdc45b781b2f541d5a5290f5167d909a86caf6490dacdec8d0a94d

memory/4360-121-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 873c80eca5153eb35f77948c8156bb0a
SHA1 ae038494a53f971c1235a3692ca98b72238f8b3e
SHA256 d2a79fcfe6804733062b8253c1a6fb411a64c4422bb3db11ccc3e3e7f1feb668
SHA512 ad84e49d8a54c3daf4cbb3c4b8c45c43351ac860f1a38b934393b2d786be41f7a119a488d1df37648464c352910a8360a55e85734da93b865c79d85ffb111737

memory/1348-129-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/468-131-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3032-133-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/468-135-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 60751ef6d1e2ceb5c8003b48a8b7f1ef
SHA1 4aad9a961b346e6bd0f438eaa8890135699c5807
SHA256 bb65b72c2363a8ab1bfaf8eb13192bea90fffa3cb37b3a591b0938a2b74d9e49
SHA512 0c978eafed4a320068de19b68e567cb5b8eaa2c634629b7162d43548748831af53acfd1f3c76a2c20b69ef0c9579026735eb1c74ed47c1e400150b8c0c1758f7

memory/4236-140-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4236-149-0x0000000000A10000-0x0000000000A70000-memory.dmp

memory/4760-148-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2264-152-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 d4ffcae33651cab668a51ed5eb3cea24
SHA1 e5e17c2e3d6fabeff2525f605163daf4c5ae56e0
SHA256 ce598715e4011a227e3e4c3760c02870cfcabaf7432138ccc67b7eaefaccd557
SHA512 01bc884397e4ea776e78fed9407dde1d400c1c179c86de87f1e42565d25533fa860cda84bb9d6c2b860cdffac7b6772245a4c8cb727316ab301e9757cf865cea

C:\Windows\System32\AgentService.exe

MD5 5eae09890610f7fcce2c574c2dcab10c
SHA1 87a30a413aab9250fdc61ab708cb6fda6c5d79b6
SHA256 23e87d173ab2657c01233add59cab2c4863911c26287f4635aec1ed046da0394
SHA512 37161db2930282d1656f5a1c2285476737e2229babd50845191b01a70167bc9c2bb5adc120936dbb1d62c3c87e6d9b84d2509e914094fa6d77f1c22867918a5a

memory/1764-155-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1772-156-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1772-158-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 31e3fc127aa2389e45cf800a0d08d4ea
SHA1 ed570f89c9855589beae70dcf047fb23233b0a8c
SHA256 1f3184d7c21f9df20b4e4f065ff3c5d237576d9fd50edb4c80e5b111aba9bbd7
SHA512 ad646e7814c8752c7786753c6410e14e12a5980f745080deeac95444cdd5ac2a9d09397c815e508c97ae87dee60819ac80f893cfdf88b9c942f3408d0d18a12f

memory/3512-160-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 70b01a550ac1c4c4cc708046cdcd44cb
SHA1 2dd5030b44aad840404e575aee7390ac666c62db
SHA256 6673ddee0f36daee5ad9eab94a94a928b80da3edc2a62d52f0b8a8c146c01218
SHA512 157665ecfbd37cdb6bfef8f507a95ebc3959361d2dfa201944d5ce1f27a8b925bdc8037009ae22d33417aef32acb75280e8435e7cae8f13dc0d636cd99e32723

memory/4104-163-0x0000000140000000-0x0000000140095000-memory.dmp

memory/780-164-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 5f8110ff320abd44bbc684d346df3647
SHA1 c7f1ade257b03eb3609a0b2b583438ae3627b412
SHA256 2b039817f06aad41e635a44b7204229266bae7658529bddf36d3832876939049
SHA512 8857bb36f7b589b6268c20e64b736126a4307511e049e1ba63925e7ee27726fc75097a14c82d458cf8274406333860db74b0e88f50b796649c37026fd1a179d3

memory/5036-167-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 bb0a58557cd0388ef44f642868f1d977
SHA1 e5cfc8a616c71f641117a970ee16e1f573d14246
SHA256 eb58b491f4fb781419f38e1241b74a5ca11b45c4a9ee15c1ef28f1022047887b
SHA512 a6c4321b35de9cda4bb4cc1bab00d54d38c237bca225ad974e4efef8cf892f639365ec1458511e5320f300d1319930e6aa232dbe52237b3dc240f11e2c5f0f44

memory/1160-169-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4360-171-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1656-173-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 be3c20f0f53d1385dbd1a9852322f183
SHA1 99e770711c01c621b71d47b12f9a5f7134452497
SHA256 699a8dbb41a828a70989fa9e2ba8ad1f2fb76a4ca5b9dd981213c1f1a75bf485
SHA512 bba0922a3eb6c06c71d35eb1876b90aa8e9e096ff0f9834e1b49965df60b99e6ab1b6b963e2debced7692fe4e784bbc656d1fe988ef237ffe8755e67fe531207

memory/3956-177-0x0000000140000000-0x0000000140179000-memory.dmp

memory/468-176-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3924-343-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-350-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-349-0x0000012558650000-0x0000012558660000-memory.dmp

memory/3924-351-0x0000012558660000-0x0000012558661000-memory.dmp

memory/4236-353-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3924-355-0x0000012558640000-0x0000012558650000-memory.dmp

memory/2264-366-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3924-368-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-375-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-387-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3512-385-0x0000000140000000-0x0000000140147000-memory.dmp

memory/780-391-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3924-392-0x0000012558640000-0x0000012558650000-memory.dmp

memory/1160-397-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3924-398-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-403-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3956-414-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3924-416-0x0000012558660000-0x0000012558661000-memory.dmp

memory/3924-415-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-424-0x0000012558640000-0x0000012558650000-memory.dmp

memory/3924-418-0x0000012558640000-0x0000012558650000-memory.dmp

C:\Users\Admin\.node_repl_history

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\system32\AppVClient.exe

MD5 830cc94ef4a8b2bec157b8f8f72c22db
SHA1 8f369a34dd64a21dd915ae504f11ff55c699efe3
SHA256 d2cef9237025e4311a646c85f359a75045b4f6aeab94be2b38239667dea5eb4c
SHA512 74a06c75ef5f748c34967d691e90bbdc7c059001fe4174b4edaed13ac38aa21d1d435b7592393412f79a3af615d21ed8c08e4983914d07b5b47d9fd1f55b207c

C:\Windows\system32\SgrmBroker.exe

MD5 d8c59cee40d496be0ca2eb24876acafe
SHA1 a147554aec5b2a8a57752763ef9707d242d5382c
SHA256 d61f06d2faa600ad9c11bcb813f9e85f75d7a67213a9d6ce9849174175e68651
SHA512 781d23a70be8f53bf40284e67341bb814410197d7ad0ec0139fd56263a0818c0f1b59f1fe4778cd2f0c0c5264f030bc6d64ca6cf047c62bac4073669f972393f

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 be8143569e61ff3deaa42f5b778cf364
SHA1 8497f86815178000548faa751a1e0858c24c6a02
SHA256 171ac37db96742477e9e04f51ac07f3fb38d251f04b9a13737510f452cb25cfd
SHA512 99f545a1d364943c2dd2c14fc48b6cc8f4db7e9a8bfa5823ebd0058ae3345997cf08a0e4b5dda7ebb1bb7eb5df71a18164735c8096a4b7bbab75843539ccfe2f

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 b0985f39b6e6f299915e22a19cb7e7b5
SHA1 848e9dd2aad0de154dcfa90176cde5e343a787e5
SHA256 c93a9187b1ab0dfd3d01bdb8f37b5569c103d9e30002a08615692ad19737b394
SHA512 17a96d59ecb6f7bf312fa160a2ba0eea39ce16831f797a94e9a812d4146ea6cb4ccd5b1c1375d10881cc192684fb96b4ca3cf4caa2964c2eedca1e4311162f62

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 0f9ca67d00d8e5d04487e8b42b4003c9
SHA1 49b4ed14b46f02224f16015a29d37f1a8a991572
SHA256 b82a7717cb710c0097d2bbed42bf65111708df02a3ae5cb184af37fa9d01e11f
SHA512 71aff05590cc8cb94293594f74626ba811180b13d606824e712ad1019a41db83eb371f4b6c778947cef2765d24f352f325aed77c239c4b2be5522382f288479a

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 605358878ee3a675cf3de0f9375ee106
SHA1 afee34ea387c79125a73860b7e8b9014e0ce2536
SHA256 c935b7695cc9adb7865bfc72bdaea6155d13adb209fa0ee46aa88e0b2e38fca5
SHA512 9ea98c2e9b96140d37ff16fa321654c00e2ac6d16b5b32f36c63f574f2ef0a5141f08167eba75a5a59e1055e71b95a01eb6c9e9b37a01f257b6663c1a6262e43

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 3c546d80cbafdcac6df7e8704ee75c91
SHA1 4964ba8398deb60037f68bdf14712698cb566c3b
SHA256 740c41b9abc025f7003e10ed0470069ede626594b71d61787f77a0a27b56c253
SHA512 fd6f98cd92fa79723b8061ff09dd0f258c3443193cacb322a13aab709e79f35580cf281213096b6cc861a98e7dcdcb4300e08ff5701aa8629b9a63ad12f9e4d6

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ea305022f690ed6a53ec0713cceae23f
SHA1 1b7573263c4cf8259677b3887e6adbada2965d58
SHA256 3b2eec4528d3cba52a09dbd8b0ab6f6928a1cf178bc20c1bad231cb032b23ed3
SHA512 06b8476b96367392f8f8c306d1c462af319e4db5ed1fa2b7f4c552216752bd2f0a31d190e14ebca951ee4c0b8030f26e4b39ed33c1e472cb6feaae6e980f572e

C:\Program Files\7-Zip\Uninstall.exe

MD5 ab9b71e055f0692f80460760c42b1313
SHA1 f2afa4138857b01a3c24a3c2590b16c0746cde3d
SHA256 815432bd814dacdc4c31e158cccd7103e8074a3a2ff2fc875b884d40cd7814c4
SHA512 93367ba89d158d4f29b0a4b1720adfa03162a525d4d93d83b7f0fe40d0b4d69831a5104bf90d6130f039638358e16b0227b4d4d92f8474a9079d7e41968410d6

C:\Program Files\7-Zip\7zG.exe

MD5 4d669f351a72ff1012315eb0dee7e534
SHA1 979a801d4e5d4e88ef77b02327bee68b792635fe
SHA256 1d8b3be79699a8e22bb774b8de3cfd8500b632bc80662693781a1878529797e1
SHA512 6323aaed727cae6bf35d57841eb7a7580ca3fe6286093ee8f6e11f92b4cbaf2af5609e24724103f096646abd674930fe6261dd6de444f78dec1585bdf176a802

C:\Program Files\7-Zip\7zFM.exe

MD5 c4ed604dbd6fcb51b136ccbd1bf0bce5
SHA1 88083b97d3e5924934bb05e49769d14894c06960
SHA256 e87fb5bec77b8bb7ea037115d9762b07e9729a960a37625d4e211f90b56c3aac
SHA512 5c49ec848261e99f980b6d1089d49e2865d67da551ed3b4b0fc7db6e5ff3f114a7348921e15e4e4a96430ecf1e57a36a2efc1cfca1ba85b81c597793cd7cacae

C:\Program Files\7-Zip\7z.exe

MD5 292061795c137adce026124d10da1122
SHA1 6ec70d70eab30271591c1774f43926fcfbe296d4
SHA256 cdbbe8d2f11cd27d00b51d1acf668395a39ce927b1757bcb39f3bab6b5e97d02
SHA512 8c9c960bc473b1942140aa4bbe99c396b7453da17314d1081bf4cb5314991dda7cd03bc88c9b54ab63bb6151650e6352548a9d54c11b01d7352b541d3932195d

C:\odt\office2016setup.exe

MD5 cb7121051402e6b71971224200abf572
SHA1 7b6099ba4564413c550455fbc45dd9655698fc74
SHA256 af3272a8cbde8df95ca9ac83c22980f3855e238027ac90b2d64dbe4b92485a27
SHA512 9f5d47b7ddd541cf4417cd9068562bf29cd5b655aca8f8360a1e4df328e8bbaf12500843e8f7909c177f5a222c4791da2a5685e68458f25d154a241138c02fdb

C:\Windows\system32\msiexec.exe

MD5 50bab183875e3477ea757f8100d2e24a
SHA1 eca35f38741b1684bdad93402a9fd5193d7fc10a
SHA256 fd80c9c2e0c48b4cd098d6502f1c5c4f60735638d5e0c1d6e0df78056431e55c
SHA512 5d5a8dc1010fba402038aa1935f48a6c688f85d69331efbe879ef38b10ea974dd32c0232975f22e0f0672bfed9ee7228ae47ae83d9516deaba392c715f168ee8

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 906fd36fdf0533aee7d38c97319e7901
SHA1 9c65c346195056e838c782be5ed70fc99cdb41bb
SHA256 d1933cfc62a6972a09af06935f8f02902c5690dc25d1401646b582779454b0b3
SHA512 149e85be696416a977b22f6c519da7fa053b69f22977641c15cefc0f513a4b20d4103eb599523dcfc65bd4f7e00323c9c2c7f62542f638b20ff594a7894f46e5

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 f0c03378742d3c147e78cf13bd279596
SHA1 0986164d337777ffc810b0eff00d631de119e773
SHA256 207820e68b9938fea09ba36ed80b2ac640f57b5dad8a56a0004a8397b52b4179
SHA512 318e779352d2fe82ad5e0ff852010fc0ca19593c3b7a343c3efe1684e647eca523edfe4075c7fda13ea331ddd7611e781691c93d33647a70b4f2d26523bc484d

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 0051e65d6aeefcf074137162fd379428
SHA1 2181f29ea4d610d327f0fd5ebc084fea9a38447a
SHA256 e7ddf0b44cc48897237cd0ca27c8a63af3e46b286349897e416612e09a4f1a5a
SHA512 4a81fa08ec734a7cdebc4fe5bdde83a60825710602803b3c6135f110095f08b8462263cf14ac2b2d4f6f49cc0497d8e263e508b35cf491c7c8853d4d4779b13d

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 e51645b7d3f09e76a7587be9a4977149
SHA1 7f469a0391c75b65aa8c75b2d43585f545b9a2e3
SHA256 d2856ae483a0c5e382093f7b6e5165832fe433e49de9fc308193c37ad065a059
SHA512 ecaaae9f6e56379d3d60a8f7e441573f7ca82d9905f4501b344d0a7a9450eddd5bbffcddf07e057e06dea14956c8ed92a70cb6d576dbcc7a949ca921b3e25bd7

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 d8b2f1e8566e2ec4528b9c3e88250f4d
SHA1 6b83f842889adb1d5166f356c6c8d890599adb7b
SHA256 88c22d8ea6b943ebd64692832e8f14ae946a5d1415247efe2324836d080ea7a3
SHA512 cd6c33c4873f1e775602077672cdf1e760e90a7ee77aaf20508872424b1ff8cf73b27a3d74fb60484d36849595433fce316e345c7651fb9fa472d24645fdd888

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 706882713562596b8fb486b512e9b17d
SHA1 021eaf1447b9dc8ece017e5ac5634e42802249fd
SHA256 06b871ff8615bcf9407891d77a8902055a1f5902b36e5501ff16964695ad551c
SHA512 8a33910a989d2fb937cd18fc7fe3ca2f1d18865eb13ae67c6eec72c5ebbadd17477fafa7061f36cf31e5fe04a152234f6f3a633e5ba7864f1a86dc19201b3be0

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 19a4d445e90eacb558716aba0b9e2c90
SHA1 fbf3a363d9f400c5f0401d797930edde6d0ef203
SHA256 81de828ce6e7d8f507a649cf8316cf2184c435099861e82c965f0fcd84189ae2
SHA512 19f678fef791c0c802fdeb0a6a51d11dd04b4960c64765812e1cdb3c0d61dc2c523db68238195081b930ad1b48a670296310ca536a5aa9c34c1ad1a904d644d0

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c7d13cae8fb7fcc168b5b291dc3dce98
SHA1 ab7d3e1372ea11ad13c1d802a1a0a980dbb1e218
SHA256 7e255b0b7588b0ee711b64ea370a9288b75bd0abbd625c2e28a00356930b29c1
SHA512 5a512b8c353be9d2241bfd568d13f2b227155e28d71816fd0b2d859e49d929294905f550d5501fd5f0286f0f23f5d997901233deda307fc11143558cd402ecf1

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 684e9b0334867692ef228da0aa65f4e1
SHA1 db488bf8e2a8d2e50cc3513fe2cd116542ce58ee
SHA256 605cf22f0e4c200a42ff13b976afb2cfde4be419bd821cdaada9e159b32fedd7
SHA512 abf588b98612c729f0022a8f586e2979ea26dcd60e7bbb4073556d4715774e43b982b681adefe1c4afe8cd03ca166cbeba29c0b15c344ff4a81688dd90ce18ed

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 3e0db7649be20e04917e9dc0a4013bb0
SHA1 5ee691afbf01c9b7b3e857be43a1c8b59c5712ac
SHA256 643a9921893d36d9357758c721255804bd3de2182ac4f7b1bf10716602eff4dc
SHA512 f42b13ae37d6ef39ccf39c5a1361ec9f10d1b4f14824ba9555dae07fc817d5894c347ce6f99b476c526c4ea0e5605d32f98d02ae2efa9900ebe84392ce0e0241

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 4596b7753a1735e60a32a90fb93c8add
SHA1 3ee3335a07cfb322c42043ae623b032540871798
SHA256 c07c2987f080f1e6692d66589d06cf024e2133b1865ed453d354852a83fba83f
SHA512 9d1f67a835f7cf4d02dee600045f7da23624d9f39f889a668090cc16fa84495bdcf5bc9278ee157053f79fda6edfa2583051fc388f633c4517cf08bf6c566976

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 d31b8c3f27da68b3977455a57295016b
SHA1 542d187c031f237238121305359f69a1eb085e9b
SHA256 1d192aab2cb84e43044296c69935b552aa228fc1754b449ccda95f278d128514
SHA512 a7408517af53f9bc09a52a6ab1dbfeafb42f04e0cffed99e3bb13f54e3db31a7b1c8b76b304e189e767b382fca628b6661e78a88f17d1aba2482983bb34a3d41

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 d7c0a875457b4a2843f0ca0f9e78611e
SHA1 0e0684877a7e056787cc9aa6a26b44ed5312cc9a
SHA256 600d420cbc5b7b8bceb563ed45c9207f5bb5542161229d724887e6cd409fe13e
SHA512 6fa97fdfceca3de009f56e5968487250aa14301c0484c21d8916bd9e436e16e041e32c9e8b9c7f7123b958b4e552f013b7992f027f71b02af42a2db5901be04d

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 ca95b2c688cc2983d51eaf75277dd400
SHA1 c1a0ecbf7a10a27dbf239cda0cdce853858f578e
SHA256 4798c1c18f56f21eb4cac2eda592f28ac30607e769bcea93f824f022fa28c1d3
SHA512 3291ec4da352b3ee70c244a35c2707feb348695de58ade57fc9357f540eb3677fad059f513ef09f2d695efdb19fc36064bd215715254f463c81f164fbe221c99

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 57f29960d24072667c1eb356d78da79e
SHA1 cf1ebd7a4224b0d9c945e85b29d7c1eacd6c25b8
SHA256 1c5cc7690525620690c00ee8dd2e33b003758af055cb9e481e4a3f57349be618
SHA512 8bceb3f5c3c638ab15ac523ea999bf4e8d72e52426210555eb620ebda44e4bec9b3861d03dd6611b297689955a48cb3d694b0d1fdf7f290d501e7ab172a7087c

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 40cc89fd6a7b2660b41fd1bc2653be22
SHA1 63d4e0c2115edac9b2bde9f9b7b57865035efa12
SHA256 28e2445546de1965e0dbc94e5da8bd01cebc329b8c6400116723d5b714c5cfed
SHA512 2bf40bc13c121c092fea3f78d3acf53d1b6005106eed61fb1d2185b2d658e715e4c23df3d4aca4e64f23f1e922c24c9c2c36fc6a19f986edfaead5a2fd69cb80

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 6c343ff589742c5f55c24391a31b1d6e
SHA1 8d9ce92499e01ca2f35abe63901575b23d8ff06d
SHA256 2f02ade571cfc6f102cf2e1218bb95ea40db75244d5cbf788643ceaf03038de1
SHA512 a50645265ed4fe29b1691009de731dc4077edb74d87874ddb8299f6f193559985f2d84a745549732945a4de695aa4a0d1b1dd4d6f4b29545af2e5760a636b9e9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 e6facb02011c9b2b0ad678f4224ff802
SHA1 9d572c793061eb0c13d610f06230a04239424481
SHA256 4cd293387b9ca8ce83351eb9aa2611734a293e6390c99d7b64a8393afcc53923
SHA512 0a57ad59928fecab3f36f5fcbbe6213792578b436ea5bb4a5cdfbf872e63abf359c7fc0a0c0564f3eb20b978113d341826e6939bacf802657dcdd474b6831ab4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 a5bb8996a84cdd12e3ffb41a0b52e64f
SHA1 19b3f5098a7748c7bcd503a3f126462c19b2c317
SHA256 6671f309db31b845af96c83d8964b8087642c310b62045e08602827f87fe1a26
SHA512 05f4449a5fe51e16942ab3e8a8f6a056cc42e6640e74f78902de6070675dae0e9ba782b7ecb256e9dc22293849ea7eae425f18b86e0057861ae908d2198f4230

C:\Program Files\dotnet\dotnet.exe

MD5 1c22068703512ad01dee1e1d62d7104e
SHA1 63371b11d690ea856aa8199ed32c27f378b8bc53
SHA256 8885fde90fbb3f2eb8fbf8f3367fe6ab27119abcf9a4285638ef5d1fad307465
SHA512 8c121590be474aa758a9a5306ac3e297963ec72e28685a7082d72275fe5be15c420ec6405e87d8f731408181dca3cf6bf9214fdb03bdc38833cc71bbe09f5968

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 ebb6018ebbb6973ccb8119d80777fb11
SHA1 628547789c05955839df0460be3e82504d6df758
SHA256 fd6417488da99879cb3a271f0d60bea473b8d2ceec76e475cbd4c9d55c76f871
SHA512 c780d6f829785819250f67ed4d03869e6070bf06034393da55583f8848570015bcfa89ba21a3430bda361f84747fd50498f6e91428824c5dced1f51277c1b22e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 c26901d8a512ae90c2408d6788e55b38
SHA1 37da5a3595b54d0f824ec354018a008ad73882e3
SHA256 20077356048c4af186a55b7c06ea794925ce73b941f188e50277fc1b76fe7f97
SHA512 32ffc1d3a04308103975d523ec9ae1a81d9e27b25e2b905c993ed230a62630fcc470b0788979d0007ae84a61701e82819f7c7114f90cc09753a93abc7d871dc5