Analysis

  • max time kernel
    46s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:23

General

  • Target

    2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

  • Size

    4.7MB

  • MD5

    1ec78ac0898f63c64eb19b0475e2322e

  • SHA1

    bbbbf53c06c387bf2dbc69d779c20826512d1c8d

  • SHA256

    a70135b3bf5c57e6d39dd6e9b16b25839b679fe0c44254459cfdafa8cabe4519

  • SHA512

    6bb82dfcb3e1a36de9aa362cb9ca7a26eb70a46c2d8aae010d5b73feba0fd18c833051701379c6d03c1897cb5085ada3c541fc548b8f02fc365c355873d4f159

  • SSDEEP

    98304:KqJkdmBucaT57K3C4qJ31B0G0c5S2uf+bGhGmv5:L2dV7VK8tj0QufMC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 22 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2884
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2004
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2476
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2484
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2660
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 258 -NGENProcess 25c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
        PID:2736
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 258 -NGENProcess 2dc -Pipe 25c -Comment "NGen Worker Process"
        2⤵
          PID:5116
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 238 -NGENProcess 254 -Pipe 26c -Comment "NGen Worker Process"
          2⤵
            PID:4444
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          1⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:2536
        • C:\Windows\system32\dllhost.exe
          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
          1⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1636
        • C:\Windows\ehome\ehRecvr.exe
          C:\Windows\ehome\ehRecvr.exe
          1⤵
          • Executes dropped EXE
          PID:2292
        • C:\Windows\ehome\ehsched.exe
          C:\Windows\ehome\ehsched.exe
          1⤵
          • Executes dropped EXE
          PID:2380
        • C:\Windows\eHome\EhTray.exe
          "C:\Windows\eHome\EhTray.exe" /nav:-2
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2012
        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
          1⤵
            PID:2972
          • C:\Windows\system32\IEEtwCollector.exe
            C:\Windows\system32\IEEtwCollector.exe /V
            1⤵
              PID:1100
            • C:\Windows\ehome\ehRec.exe
              C:\Windows\ehome\ehRec.exe -Embedding
              1⤵
                PID:524
              • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                1⤵
                  PID:2920
                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                  1⤵
                    PID:2240
                  • C:\Windows\System32\msdtc.exe
                    C:\Windows\System32\msdtc.exe
                    1⤵
                      PID:1316
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                        PID:2724
                      • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                        "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                        1⤵
                          PID:2216
                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                          1⤵
                            PID:3480
                          • C:\Windows\SysWow64\perfhost.exe
                            C:\Windows\SysWow64\perfhost.exe
                            1⤵
                              PID:4108
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                                PID:4408
                              • C:\Windows\System32\snmptrap.exe
                                C:\Windows\System32\snmptrap.exe
                                1⤵
                                  PID:4632
                                • C:\Windows\System32\vds.exe
                                  C:\Windows\System32\vds.exe
                                  1⤵
                                    PID:4744
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                      PID:4860
                                    • C:\Windows\system32\wbengine.exe
                                      "C:\Windows\system32\wbengine.exe"
                                      1⤵
                                        PID:4960
                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                        1⤵
                                          PID:5080
                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                          1⤵
                                            PID:1864
                                          • C:\Windows\system32\SearchIndexer.exe
                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                            1⤵
                                              PID:4060

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                              Filesize

                                              1.3MB

                                              MD5

                                              ff8c650fac249e017bf6ae223df043cc

                                              SHA1

                                              57eda4f29f5d1886fc636d6be38b918b6501b6c0

                                              SHA256

                                              e7fd2bb48b0817ddd4cef0c5677e35ee41336c7728c640a7df8ea27ebfebf1d3

                                              SHA512

                                              ac98c8640c33ce9fdbc60aa17d945e232c7377884f9032dec182a4745d225577c03d25ef62096bdf1379d1b868435a412c5be69f12bd05e4d0a7426cc1a76229

                                            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                              Filesize

                                              30.1MB

                                              MD5

                                              61e00979743562fbb6ed8d57964a2451

                                              SHA1

                                              12e59898f6594be5034130e0c89956b8379e7069

                                              SHA256

                                              d3899aafccd4f2836ac2fe11093c0a14b64fa83bad9a2df8b73e42981876d2cf

                                              SHA512

                                              d1a840620e15fd0248a5082a374382339185a25e469dd91e873123d31c80cf3948ae8d592e07180fa259e1520435452b4b641664ddb689638eeabad8bd635c43

                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              e059d4352f6ac0cd35e27c9c1b5a51cc

                                              SHA1

                                              33666228eee37dfe5092489f53ac7a914fdc1474

                                              SHA256

                                              af1c5ea3220921ca38473221831e261e8cafc78fca1ca15d653024fd99d1a71b

                                              SHA512

                                              473ad574a09822e90f54dedf5b799ddf682b94ab72c75104a8a3ab55df2a1c2913abed4b36701cd02470251d0aeb13ab33d8dd088b015f8cd38f2cf40d1eaa2a

                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                              Filesize

                                              5.2MB

                                              MD5

                                              35047e06b1ceab764da227f4df506844

                                              SHA1

                                              3b1b0a5ec4605cdce8989aac84c55db70af11e57

                                              SHA256

                                              713f8585496d3f1546a20a049e5bd1754f03bbdcb18185e511df1a65422b6677

                                              SHA512

                                              109532e56961c7fbf962220fd2327b50b092f5dfc04c8313b1b285e825cb1ba06b6f1ae7924bbbd4bf2cdbaf950dec63cc9df21ae25c9b67d816706da04765d6

                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                              Filesize

                                              2.1MB

                                              MD5

                                              ed36b0d319098979adf6086ff5bad38d

                                              SHA1

                                              24ac7335cc352f32fb485b2b0e40fccc412821a9

                                              SHA256

                                              d250c4f2c0173803a84b727d780dfdd69b87efea0997fca21b3e0c133de4059e

                                              SHA512

                                              fde12ad4620a18be91a7a38791cd8f3b061903759ed4add7c4c8dc08f166362486c2acd45d32b00c4f23c5d7c5ee9c253f3008df1a65c707b681d6732996c417

                                            • C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

                                              Filesize

                                              15KB

                                              MD5

                                              577b7286c7b05cecde9bea0a0d39740e

                                              SHA1

                                              144d97afe83738177a2dbe43994f14ec11e44b53

                                              SHA256

                                              983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

                                              SHA512

                                              8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

                                            • C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

                                              Filesize

                                              20KB

                                              MD5

                                              00bf35778a90f9dfa68ce0d1a032d9b5

                                              SHA1

                                              de6a3d102de9a186e1585be14b49390dcb9605d6

                                              SHA256

                                              cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                                              SHA512

                                              342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                                            • C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                                              Filesize

                                              23B

                                              MD5

                                              836dd6b25a8902af48cd52738b675e4b

                                              SHA1

                                              449347c06a872bedf311046bca8d316bfba3830b

                                              SHA256

                                              6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                                              SHA512

                                              6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              2af750cade358576621e3d944f5f44ec

                                              SHA1

                                              9fd77e12ff6fb404f3d56804df2d34dc0bb9df4d

                                              SHA256

                                              7eeea1b452b22f559bf2f632e079f318e19bf8bd18d0e66dd58472fb272d0095

                                              SHA512

                                              3c2bf48d57917b83d7660a5227597c44fb3b88d0d79f12230dfbf54bb12abd6f3740a5e9b8e4e96dabc479fc32f4cadec8c41377b8f4aba294e5a1bdbbcf8c08

                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                              Filesize

                                              872KB

                                              MD5

                                              90fe207923f2ef71500260041f967861

                                              SHA1

                                              a79ab1e369ec668df224f3e5105d1c14fbf70dd8

                                              SHA256

                                              f356fe9d2c3ea7416869ef00695530b0af109e3c85281c1cf66105652bd6b14c

                                              SHA512

                                              09e6bb5cd21c8e07f64b632d713cd765596909960cf9f0720b49c57e5abd94755383342a30f200d4b9ac5209798e98f8375d7b350123bf7d2f8b4df69102ca6a

                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              4b144d42b73e7be090574495f6c4ae61

                                              SHA1

                                              3aacd11e60beff92966dea13259b136b26abfb3f

                                              SHA256

                                              17a5982fe2247365ac3df1733442627cb600607971872e4ef003f0ce9d72fe2e

                                              SHA512

                                              755baeda93a24232a894b642b79f33f40edf98be9a0f13a2c1ab6da803acc86eafab0c948d40ec24adb96e85c5100377a831bf3f0238213fccb9d9cd5f38f7fc

                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              4ad95acc117e51080a560cfdb81eb7e6

                                              SHA1

                                              42e2793bffa6b38513595ff40712b76e6185ef73

                                              SHA256

                                              38ea809ec438e0aaf62f406f8661335fac4965a9f6895586f06dd6ffb538b2bc

                                              SHA512

                                              c0f6a23f8273d59adf9e89870a30cd2dd027fb79b2a2df9f6a80b3228cb54a8380108a170ca647b052af13f961cf55b628fca2ae86689cedd57a0c7a54970d31

                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              88ce0d62c8bdf226767f26c0bb890ebd

                                              SHA1

                                              985cc54e8d7ac11b858198647b4e5b57b944e874

                                              SHA256

                                              626a914d801c69f71b538ff2f0541b4a9304d671b01108c1aa7e9a2e7ea2d908

                                              SHA512

                                              caa99c4ee5e2218e7ec792f6d98476053173555e9ca53b074d0982cbe5637f15311e102f490020980fba28ff4aba2301873a2d31c3eeb69de472f00684162f7a

                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                              Filesize

                                              1003KB

                                              MD5

                                              5c7221f85f02c19eeac0e5555fb9d7ff

                                              SHA1

                                              56bfeb8be0ee1c0e196f1d3e8e4ed7e20cf8b86f

                                              SHA256

                                              962d8f269980f9616acbc5609514f0071692b108ce731b32107e7a42c4d4b7b3

                                              SHA512

                                              d5117d0a0a6e4643d19d8400fe8ea4d5aac89b03be679c3032c32c76e0fd912f44f907562b1baeae99155117c573e34888b914cee783e0c7455f48549e4c0fc8

                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              d783d98fa0ccdbfdefe5cf641beed0c7

                                              SHA1

                                              ea11d7ecb7d1d160ea632c65bf45b5edef57e2a0

                                              SHA256

                                              760e5741b75e7fcfa6bac1be6fada4ab084fae733b10cc1b0a4a947dd438c403

                                              SHA512

                                              448732397f0bf2716ff88e46012373ada47506a52e088a5e38239270bb1875a41297c6e19b039d936d1e7aa43a39296e230261d00efc489ea331df132add83c8

                                            • C:\Windows\SysWOW64\perfhost.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              44969865b7b3ae265719dd7258fb531f

                                              SHA1

                                              f31d57735a529d0620f4c10d460a5a6de2bfe0a5

                                              SHA256

                                              ad0e0f291db19605b53839781dd57b3b2d0756b5ca87f87b2ae561df1abafab0

                                              SHA512

                                              952739be85e621f259b04b59e6f9aa106ae51f37c59fe9e5678cd64751b2c5c6ff55c12e0b981e5682ae4d166258c64a7a3f4fd7845690c238f98da6803fcf26

                                            • C:\Windows\System32\SearchIndexer.exe

                                              Filesize

                                              1.1MB

                                              MD5

                                              915dc01b1c893eb07aa0fd24f9c2d5a8

                                              SHA1

                                              b201406c6397d34040a285f8ccdeaafcc18bec2e

                                              SHA256

                                              e382074b662ee5c4bb161aa300398914a171c7c3254adef9cfa8d78252ec4bc3

                                              SHA512

                                              3279a8986547b13bd2d81676dd224adcc50b5299cca35af77ec5d72db2edcd2466cd041dcee8568123237ed2db3df7297eaf3c922d04fba2331e43d833344b8d

                                            • C:\Windows\System32\VSSVC.exe

                                              Filesize

                                              2.1MB

                                              MD5

                                              179514ee67c1f159719056fc5f5c8cbf

                                              SHA1

                                              8d90791a2fa92e79e1084d7fa2743d6e1f69993f

                                              SHA256

                                              dde759196c118a19f2ef30dc57ddae1602d8d2c77576a0ed0511d58797748d3a

                                              SHA512

                                              ff4275145b38e7b1a55f776e7b345cc48d68196df24418718a064b39c546de071460fd3205390b134d9a977038815289f01dfeccdbcf61faa3cba7dc3f5c95e8

                                            • C:\Windows\System32\alg.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              3dad3e1cb36dd2f7707f51a96ac83c69

                                              SHA1

                                              ac39045a733601ebba7e8aade986f653d3ecc8b3

                                              SHA256

                                              93f59414139d1c2f074df76b20255c37a0070f95a4d4867e2796dbf2fc11ab96

                                              SHA512

                                              f7e925e139a080d85a0f064687569b311d4fa4dc655ee49f334c33b60ea06dbcc492c942631dee2e1d6924ddadd9be1879002e2319898c4c11a06aeda991d5ab

                                            • C:\Windows\System32\msiexec.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              b46284f6848954b2b99d94ec98705788

                                              SHA1

                                              4ba38e947812555d000dd45c15c6ffe712a02827

                                              SHA256

                                              e05bf1e6fb8571ae9eef89abb2209effa2bef5063d5105f9b382514266e64917

                                              SHA512

                                              7f618aad519f587222e04cb64300556022135ebf71ed686fcab9dbed2282fb8d191b2b31f5caa9a022b60cbb7aae5d470ea6e3abd2a549f746871685380ebdcd

                                            • C:\Windows\System32\vds.exe

                                              Filesize

                                              1.7MB

                                              MD5

                                              cf29486e0b62f2813d6f565c3b2094d7

                                              SHA1

                                              e56bd499a023c3665a7646c2bfd4765c2aa3992f

                                              SHA256

                                              3a86dc585d84615250510c0d1e3e57611c23552499f30547cca8da73ee0d07c5

                                              SHA512

                                              e72d3143fcdac624c51e8f9909391cb01961899ffe2a1803a5961e5d5e2b6e0622812081825ea6bcf10d98e985716bca626558fbec1c89e8c3364afa5ad8d544

                                            • C:\Windows\System32\wbem\WmiApSrv.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              2cb094329bf947b6de89e952b8788e97

                                              SHA1

                                              75ab4e7fbcc27f4bbc1531d8c030e2db2850e146

                                              SHA256

                                              7ce7f0d3e7ee0fb1a6b0974f1b1362dd9f01a8dab9d9115dbe774fee33fb0c8f

                                              SHA512

                                              4974effdf434b376c1a9fff73944222376728e319e9821e3426b1aac36f15b31608d29f77dd65b244f6cdd2d405d89a530926fa23136288788a05d6baee77774

                                            • C:\Windows\ehome\ehsched.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              5c7d67ca186df92805bd2302d4a24166

                                              SHA1

                                              8d798bacabd5eeab8c56b74734ca9b00c4a010bf

                                              SHA256

                                              fae03944427a02be25a4be6dacd64a0b355caade8f71ba8fc4e5a81fd99ade5e

                                              SHA512

                                              054c4f1ab09dfff5218c1fafe66d97996e7474f4d7e8f82fe93eb078a7800380f89c521c82ad7c1edcb1f9254782dc0150ba204b00cc4917462ae3cbe7e53477

                                            • \Program Files\Windows Media Player\wmpnetwk.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              783cf9b1b6ebdf8b184e026c8b04ddcb

                                              SHA1

                                              b2d489093a3265598077e716eb4c25f618197fdb

                                              SHA256

                                              c647c59a80e7fcdafe13ea3a9fa8fcff2316fce8cdf73dd16068ac2fe04c9d51

                                              SHA512

                                              cfeea8734b92c72a28cd40956e6a65b2254678b0a9bf71f87f2d7fdc1e2e5bd1fd6425c40fd9ef29b15884675141904e1e15d0b81805ac9a249bf757498d2a52

                                            • \Windows\System32\Locator.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              8ed2c4d4a85a187449b8af0561753100

                                              SHA1

                                              1708a64e98c08c11b3aff793ff0b2b792443a362

                                              SHA256

                                              0f36feea59b4825e71e06a9fcfb5d7d3c4f932fd7ff9e5e296269201f0b0f723

                                              SHA512

                                              295c3f1a81bf45d8ace713b7baa04a885a1822029aff9a79cb292a7ed11396ac7299b83339b05f6e5c536dca19033821d4eaf6efb1ae8a08595a153db45bd155

                                            • \Windows\System32\dllhost.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              f21b61c5d40f01940ab3d058e6ac6ba8

                                              SHA1

                                              f9b27bd6d64ee6b36e046439c9f1a54a0649e89b

                                              SHA256

                                              0f02647cf9de9013014dbcd86b5c0b8bae87aef4332d82ca7de23feb07b7411a

                                              SHA512

                                              bf0209d8d15a94016efb4f0a96b886cdbcdcf57d406bb350d42e579137e4dc6f4be9a624e242817eb4b20300787f4c54af45cd8cc16b05a9be899fa4b7449201

                                            • \Windows\System32\ieetwcollector.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              00c0697229a033e916dfa874b2234171

                                              SHA1

                                              a648a670a80c4ba57721fdf77027ab2081208596

                                              SHA256

                                              00fdc9bc95e6d52fa2fffa3c5a561590d8aba29a66806ddc369a9ead3170c954

                                              SHA512

                                              944187cad4732d7c3cbc6ba02845ed25cbdd38e71861247b32df9ff8b8018e0b7c7fdba0b14b21299452ab72c549827eb1db369ada85da6345ff6b9c8d6e908c

                                            • \Windows\System32\msdtc.exe

                                              Filesize

                                              1.3MB

                                              MD5

                                              fb8d7b4efbabb387398e5ffc62b56c25

                                              SHA1

                                              d29f23c869d3072ba5ba0b0ef306d3ca006dc94e

                                              SHA256

                                              02659d4f17702d82ae0f0afa5c7ac7bc3cf530df6802d5269c7442f5ad932b5c

                                              SHA512

                                              538c0626b42f016eb677b3b4c0860f3c178a9394c11eb4931485735369cbff775521f18cd6ed4c71c23edf5303feef92ad7ab6b10bc2b76cb08234ed6c88f080

                                            • \Windows\System32\snmptrap.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              49ae14203ae757095478513bb00f7384

                                              SHA1

                                              7e2e97312918a76dc767715ea52b485d79735df4

                                              SHA256

                                              59675ace8a5607f07bb8f387d9ee836fee71540a1fc9941e7e6ca717c92dffd0

                                              SHA512

                                              22cd2846d27e2932c96f5cb6d55f231c9b57bfaa30c779dbe0e46550560df3445970455bfd03198541b0f9b727636811833d5869d272b546628dc00fd6f26867

                                            • \Windows\System32\wbengine.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              45842e7ae66d4e3997eda8ec26f00ec2

                                              SHA1

                                              c447667368eca1cb1b49af78535e78339d060fd6

                                              SHA256

                                              147505b4a5b48551c65ca1d36b31c9afd2a67dc3325a68fdfd99b4f7afdbff51

                                              SHA512

                                              1891d75d3e579e0fa5ce2e279de8b649cf6238fef2afad8d4e829933eb59d84ad73479ea5cec2afe771f6e199bf448f202b2c21d5602a49ec481b54864e40803

                                            • \Windows\ehome\ehrecvr.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              6713bb56e803d65231fef45d012c80c3

                                              SHA1

                                              8a7c38fde7555d7ca6dfb5aead29e334dccb89cb

                                              SHA256

                                              a4e5237ada3060c19396fdb041961ddf51787145116373e9d8d382699e8a67f4

                                              SHA512

                                              dba778ece9becbc9bbd25d8510abeaaad92fc76b798fc4be8eece503de1730216dd2ebf1380e4ec67b45fa538adacf78ab725640f86e3ae1e1f2be41776b80b1

                                            • memory/524-4039-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

                                              Filesize

                                              9.6MB

                                            • memory/524-2295-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

                                              Filesize

                                              9.6MB

                                            • memory/524-2358-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

                                              Filesize

                                              9.6MB

                                            • memory/524-2296-0x0000000000CA0000-0x0000000000D20000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/524-4325-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

                                              Filesize

                                              9.6MB

                                            • memory/524-4213-0x0000000000CA0000-0x0000000000D20000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/1100-1300-0x0000000140000000-0x00000001401ED000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/1100-6165-0x0000000140000000-0x00000001401ED000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/1100-1329-0x00000000001A0000-0x0000000000200000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1100-4000-0x0000000140000000-0x00000001401ED000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/1100-1299-0x00000000001A0000-0x0000000000200000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1212-1167-0x0000000000400000-0x00000000005E7000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/1212-76-0x0000000000960000-0x00000000009C7000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/1212-74-0x0000000000400000-0x00000000005E7000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/1212-82-0x0000000000960000-0x00000000009C7000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/1316-4784-0x0000000140000000-0x00000001401F5000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/1316-3472-0x0000000000170000-0x00000000001D0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1316-2923-0x0000000140000000-0x00000001401F5000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/1636-104-0x0000000100000000-0x00000001001D4000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/2004-51-0x0000000100000000-0x00000001001E3000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2004-20-0x0000000000390000-0x00000000003F0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2004-12-0x0000000000390000-0x00000000003F0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2004-13-0x0000000100000000-0x00000001001E3000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2216-6140-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/2216-4339-0x000000002E000000-0x000000002E1F4000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/2240-2750-0x00000000008E0000-0x0000000000940000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2240-2721-0x0000000140000000-0x0000000140209000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/2240-2595-0x00000000008E0000-0x0000000000940000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2240-2710-0x00000000008E0000-0x0000000000940000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2240-2619-0x0000000140000000-0x0000000140209000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/2292-110-0x0000000140000000-0x000000014013C000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/2292-111-0x0000000000820000-0x0000000000880000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2292-645-0x0000000001390000-0x00000000013A0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2292-2356-0x0000000140000000-0x000000014013C000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/2292-641-0x0000000001380000-0x0000000001390000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2292-820-0x0000000001430000-0x0000000001431000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2292-3435-0x0000000001430000-0x0000000001431000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2292-161-0x0000000000820000-0x0000000000880000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2380-291-0x0000000000270000-0x00000000002D0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2380-2625-0x0000000140000000-0x00000001401F1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2380-293-0x0000000140000000-0x00000001401F1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2380-486-0x0000000000270000-0x00000000002D0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2476-55-0x0000000140000000-0x00000001401DC000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2476-487-0x0000000140000000-0x00000001401DC000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2484-97-0x0000000010000000-0x00000000101DE000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2484-60-0x0000000010000000-0x00000000101DE000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2536-93-0x0000000140000000-0x00000001401ED000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2660-107-0x0000000010000000-0x00000000101E6000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2660-67-0x0000000010000000-0x00000000101E6000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2724-3893-0x0000000100000000-0x00000001001F1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2724-6084-0x0000000100000000-0x00000001001F1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2724-6085-0x00000000004F0000-0x00000000006E1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2724-3998-0x0000000000AB0000-0x0000000000B10000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2724-3901-0x00000000004F0000-0x00000000006E1000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2736-6134-0x0000000000400000-0x00000000005E7000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2736-4210-0x0000000000400000-0x00000000005E7000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/2736-4384-0x0000000000240000-0x00000000002A7000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/2884-6-0x00000000002E0000-0x0000000000347000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/2884-43-0x0000000000400000-0x0000000000940000-memory.dmp

                                              Filesize

                                              5.2MB

                                            • memory/2884-0-0x00000000002E0000-0x0000000000347000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/2884-3-0x0000000000400000-0x0000000000940000-memory.dmp

                                              Filesize

                                              5.2MB

                                            • memory/2920-2359-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                              Filesize

                                              30.1MB

                                            • memory/2920-1731-0x00000000006E0000-0x0000000000747000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/2920-1940-0x00000000006E0000-0x0000000000747000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/2972-993-0x0000000140000000-0x0000000140237000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/2972-1165-0x00000000002E0000-0x0000000000340000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2972-984-0x00000000002E0000-0x0000000000340000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2972-3855-0x0000000140000000-0x0000000140237000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/3480-4888-0x0000000100000000-0x0000000100542000-memory.dmp

                                              Filesize

                                              5.3MB

                                            • memory/3480-6151-0x0000000100000000-0x0000000100542000-memory.dmp

                                              Filesize

                                              5.3MB

                                            • memory/3480-6152-0x0000000073998000-0x00000000739AD000-memory.dmp

                                              Filesize

                                              84KB

                                            • memory/3480-4782-0x0000000000820000-0x0000000000880000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3480-4683-0x0000000100000000-0x0000000100542000-memory.dmp

                                              Filesize

                                              5.3MB

                                            • memory/4108-6017-0x0000000001000000-0x00000000011D5000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4408-6119-0x0000000000150000-0x00000000001B0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4408-6087-0x0000000100000000-0x00000001001D4000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4632-6136-0x00000000004A0000-0x0000000000500000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4632-6129-0x0000000100000000-0x00000001001D5000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4744-6141-0x0000000100000000-0x0000000100253000-memory.dmp

                                              Filesize

                                              2.3MB

                                            • memory/4744-6148-0x0000000000890000-0x00000000008F0000-memory.dmp

                                              Filesize

                                              384KB