Malware Analysis Report

2024-11-30 02:40

Sample ID 240407-v3gkaaac33
Target 2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver
SHA256 629040abc7e00a134db23bdf9aaa2b019574a6948554bfe5c79a200b47cae9e8
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

629040abc7e00a134db23bdf9aaa2b019574a6948554bfe5c79a200b47cae9e8

Threat Level: Shows suspicious behavior

The file 2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy WMI provider

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 17:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 17:30

Reported

2024-04-07 17:33

Platform

win7-20240215-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\system32\SearchProtocolHost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\72ccbf99bfe435d8.bin C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{AC80B0F3-6CDE-4AFD-8807-66BD429CE6F0}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{AC80B0F3-6CDE-4AFD-8807-66BD429CE6F0}.crmlog C:\Windows\system32\dllhost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{1967FEF2-723C-478F-ADB0-FF19F33850B5} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{1967FEF2-723C-478F-ADB0-FF19F33850B5} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1660 wrote to memory of 2312 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1660 wrote to memory of 2312 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1660 wrote to memory of 2312 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1904 wrote to memory of 1836 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1836 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1836 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1836 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1660 wrote to memory of 2252 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1660 wrote to memory of 2252 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1660 wrote to memory of 2252 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1904 wrote to memory of 1884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1904 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 258 -NGENProcess 248 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1d4 -NGENProcess 26c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 26c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 260 -NGENProcess 184 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 260 -NGENProcess 184 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 244 -NGENProcess 20c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 270 -NGENProcess 268 -Pipe 264 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp

Files

memory/1288-0-0x0000000000530000-0x0000000000590000-memory.dmp

memory/1288-2-0x0000000140000000-0x0000000140A0D000-memory.dmp

memory/1288-7-0x0000000000530000-0x0000000000590000-memory.dmp

memory/1288-8-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\alg.exe

MD5 a09b1172ec267b10bab9e739f29e1ba1
SHA1 a5de2deefdf067b04f40f41c473b2f068135c1be
SHA256 026e6083d76942bfc495a87cecd4797c66a4bccc4def1d3d111c2eedb52bb3c8
SHA512 015bfe2ba4a7cdb324eb6e960f52d6276d9fef3e1b1d7a9b2dc6f512e305ec4f556bc9bf38e30ec26ff5932efd0a56283a9583b9583f5b542bbe86f609152c71

memory/2584-14-0x0000000100000000-0x00000001001E3000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 2a88d2b1cded4f285b466edba08000b4
SHA1 54a57d722ff4857fd1dc9f5b3a36028436968433
SHA256 2a2b2cab4041c356db641a45f0d4bde394ef4574e6402542cff20bf881e6d638
SHA512 17ee24698f3efd7b3f71ce2b64bc62c67d844ee86ba33045e063322292dc447d17ccdd1cc75f8334a5b82b89f5c446654926465d1fcb108441dc292f97d8e794

memory/2676-18-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/2676-17-0x0000000000430000-0x0000000000490000-memory.dmp

memory/2676-24-0x0000000000430000-0x0000000000490000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 fcedfc63b0ac37dda0ca998478ecabfc
SHA1 bf67b7ac5bd4aabc0139c24cc1bf5887be0d8af1
SHA256 e141cb19a58a8b88a48f9dfb5941b8d88cb7540935a2ce94d82aa66f67f81770
SHA512 80788b67ec141d08c0160b930bc51ce71893823e318690d8e0ed2f76d87441898705ba73a4c10cee6acb12adc8338abbe393d758106fb94a6621eac192879689

memory/2296-29-0x0000000000640000-0x00000000006A7000-memory.dmp

memory/2296-33-0x0000000010000000-0x00000000101DE000-memory.dmp

memory/2296-35-0x0000000000640000-0x00000000006A7000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 bbb7b218a16d513307008cdbea9a6abe
SHA1 e420a5eb001fdf17b48869457906eea593ceddc8
SHA256 3c75a5704696ec4918a68f9409da8e39b1b6c22ac8c462f083c61078ebcadabb
SHA512 3031cf5a5151ad758e1d9caa7ce35943f6b527d9c23ec9a945f51a6e5dd60df9fb88f838442c886895c5906cf06f5c2dd5a7e7c9cb727161a51707b03ad33b3d

memory/2456-44-0x0000000010000000-0x00000000101E6000-memory.dmp

memory/2456-50-0x0000000000430000-0x0000000000490000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1c3c0bd3968691c1f162b4b5cdb7e8b0
SHA1 9c8c8c3957e5cca0e3c289e1792a9468e285eb58
SHA256 ef2cbb052c5e11e00e4ff33879a380a6104cc3b2fae72d4d949cd030b319671d
SHA512 02b87f84775650e455b6453e934fdc22748dcb3c8fb8da9ce54f639ac1a648dcb3327a4040081e8163a7756f0c26d566ef5e8ba8186d70a6d5a9e4b6af369738

memory/1904-59-0x0000000000660000-0x00000000006C7000-memory.dmp

memory/1904-63-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/1904-65-0x0000000000660000-0x00000000006C7000-memory.dmp

memory/1288-67-0x0000000140000000-0x0000000140A0D000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 4e74624ac34801d1e7a5be24aaee6951
SHA1 89599cef1f9addce94baea2328a11054ff568c98
SHA256 27ed4fb7e71805eb157cb4bf2e35e8b1873de5414de7213333f2d69a63a1feda
SHA512 b0429ab45810aa8dc1c1f1a73c640cd9871a8a87dbaca110a6704e15abd2f24c0ad5f213b7d553eaaf969e9bf00f460760a4f7039546129b2896f4f25de385a5

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 c3b8ca50226783de672c549904c8245e
SHA1 46990b89afe19ff0671ac5f18dd262e5a99a42f3
SHA256 c4175a9521e720feb4b986eb7eb019bf34979c024451ea8d2163b4fdf2432260
SHA512 bed3d70e26a0859eff270fb4ad33c7c3023e9af9386e34fbf2c32ecb9ed20aa127ecc14b8a169f0794e741d56e5e094defd5375c64b8ca1d8841824dfd1d1fb8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 0ebbe2149b3ec54599ad7e80add00cd6
SHA1 7761cf42b314ca455978c6c74f3f93796a381611
SHA256 ba9570a71a49c61ffdf97e222e07309e34d0a3309976a4411fbdcc578f3d542a
SHA512 745448936cf671f7fe463c79d649382cb3b8023a2a8d03cc51df1bd0dc0d29081782411f76387724e2555fa1cbc2fc68b302e8d183e89cc4b778c64027e5cf38

memory/1972-77-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/1972-79-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1972-84-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2584-85-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2296-94-0x0000000010000000-0x00000000101DE000-memory.dmp

memory/2456-97-0x0000000010000000-0x00000000101E6000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 516a6d3fedeaeee659210fa07c28e8d0
SHA1 8fd54f5f863eb49ac56377bedca0e0fb9400fe13
SHA256 d7819dc5a9cd345d9508161bdc95ef4383283b91f388ac229d5a1c1738f7c313
SHA512 94acb802a3a8ab57e7bd87ce40b3d342a8b2f04efac5360aeefbc08bc4b844a9c09284b7e08ace8d5424546f0d57ec275e5353b7ffc74e73513d48c87b334691

memory/2676-101-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/2328-104-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2328-100-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/2328-109-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/1568-115-0x0000000000BA0000-0x0000000000C00000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 73aa0a45b2d95e7746a27dbb2f3c5b98
SHA1 a3e7cdf4fbed3f3aa0f3b6476a06e69ba85cc9d6
SHA256 c21a516be8225c9aae70f858b832e022472ed188b5af6471c69527f5c4eb2cbe
SHA512 d3a0981370fbecf534b122988eb61ecab1d8cf1262176b10170e96051d1589b07a6182303024bc6246bfb132d7be7cd2239f5740464e1d39787e74c4ece6ca76

memory/2328-116-0x0000000001980000-0x0000000001990000-memory.dmp

memory/2328-117-0x0000000001990000-0x00000000019A0000-memory.dmp

memory/1568-119-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2328-122-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/1568-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

memory/2244-132-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 2e1a983cdaeb324ae10a7c1c2bdd92d3
SHA1 f312a78c98b3b3467eab77e34096d93ff6f28d09
SHA256 c399376d7832c1d6f0ffe45d7b125c76f0bcedb54f53d0f894cee46854bbf230
SHA512 970be1916b022a74272ce44b35f6e6b15072daf564f6cd0bc3039938f9e769f7987e45f585afc656f6101d568b8c27f3889b872bfa12ab17ae4aee62acd0d281

memory/1904-139-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2244-142-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 600c197c17260dbf5433ac61ef3c46d7
SHA1 b53e14323d18694eb511a599c8a9fb5b2908faf4
SHA256 b5a4a8b25727e88e87cda20265952a6224e6187a1d81b3dadbfbfba9d06e9c9b
SHA512 333e973746c6858fba3d1cf972dd89f521b6b7c6a11b5a01e5bac839b6fc31e94d50769f27b9acb44979a878fdcedc8ef76b187bbbfac84de46008919f38b66d

memory/356-148-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 c607d7c44cdb9891878f2a94726bb5ce
SHA1 696528286d7b1b013f30e4cf2042d988a869ad59
SHA256 77d6fc6be8b1d3371395ad3871bf9b8bb663da9b35d3b315ed25aa0eee73b258
SHA512 619f862d23caa681a21a5db241343f671bf6d0631800b77dc47fc84b48b9acd08d0b31cae0bf0575358e3949fc8eace7094a65068e539c3d50889ea3bffcffe0

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 92a91f7412b89b57c4737615947122c4
SHA1 8e6f073496d64511f744a6ce4b9e9e87ae77baaa
SHA256 c347488f233eead8d95c71f648bad269187353ccb8333b3b21f08ffc9dda8a0f
SHA512 29f3c42d6fbe9cfe33ea7de164ea02a0358b8228ba1b7e1a15dc20471eecdbed3cc38b90ac62b362546c9f35f75abba1bd31eb0630d7c289e4014c9fc4c65725

memory/1804-167-0x000007FEF4030000-0x000007FEF49CD000-memory.dmp

memory/1804-168-0x0000000000F60000-0x0000000000FE0000-memory.dmp

\Windows\System32\msdtc.exe

MD5 9d627b7eca3c4cd16519f1c80e38d9cc
SHA1 aa8d7a7872576a72d128f0fb0877397b7885b38b
SHA256 5ff640fb66e2a1af62e9e57dfec4d62aa0dfae263a94ef66209d8760a29fd305
SHA512 87a966c5ec8cf589f3e04e4ae57fb4cab9b0febc073a9841a06fc07036f80f26c479ef935b2c3181875fe9ac891e824a11566047fd3c1fd75bd0f99f89198702

memory/1864-172-0x0000000000A50000-0x0000000000AB7000-memory.dmp

memory/1804-170-0x000007FEF4030000-0x000007FEF49CD000-memory.dmp

memory/960-175-0x00000000009F0000-0x0000000000A50000-memory.dmp

memory/1972-176-0x0000000140000000-0x00000001401ED000-memory.dmp

\Windows\System32\msiexec.exe

MD5 892f064a4ae5e1c3ec934672ca877a87
SHA1 51d0834e4a2d9049e76389c2a8d6227bb06e8ddd
SHA256 b87ecd588ba2152c4c7e6fe3dd2ca69d22048567e9852fe3f4219a15a0ff3d09
SHA512 2e25967fc0a00a0dd2d22e48122add0b1c334c9d543c54fa7527f82d9e2b4b736b906bcd993dc90a67e10490c04f659b9ac8be1bdcd6151b80f7b38f433a3f8a

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 dd96b0e7b1e63e7ac3d20f8695554de7
SHA1 ae2b8a8f663217b5cc12c95e21d75b9db92f0449
SHA256 d7e0915380c46215d736fb022dea4e76c2b576e405d487c1dd671509d5b7b7d7
SHA512 ae0d8cd303b0ad79f45a2382199d6586d20ac4e9df7aeb16b8d830402321e457d9c1b1c26a3714d386b007349d3c181c171572add9b82bb538b476f0a6e4ce1b

memory/908-191-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/3032-195-0x00000000005D0000-0x00000000007C1000-memory.dmp

memory/960-194-0x00000000009F0000-0x0000000000A50000-memory.dmp

memory/960-190-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2228-199-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/1864-183-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 d92ac3b6203021156ebe0a7b7178f520
SHA1 836bdc4c0848916e403ca7f2eff00139842ca067
SHA256 829e1286f9da865404388b4f1fa78387afca07591e0699b5da63769280fc79bc
SHA512 bc5344fb73064f5d43d88d9e08f3723a96a779e46384b15ec98ab127969ff2d59c159ef51de7ef926da78fcecd289dd1429f14185096bc2bcf8e56a83c0bfd65

memory/3032-201-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/2228-203-0x00000000004B0000-0x0000000000517000-memory.dmp

memory/2328-205-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1700-204-0x0000000100000000-0x0000000100542000-memory.dmp

memory/960-174-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2636-212-0x0000000000400000-0x00000000005E7000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 f4ecad743d822ac2065d068fcc5f74c0
SHA1 e0bd4e5cd2285bfaca7fd0f59ba601980bb58a17
SHA256 da00aada207a2aa4341ba808d1e99d205f9c3c08e83c293c0cc26eb7f2610825
SHA512 8bed6991096ef49acdc7c4e50f4436c1be5d05d972abb3379af250b06b26b1c6d704c0db92332a582d4b701ff45f7b15bfd298f90722ff658b8220e63c9e0937

memory/1568-217-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2328-223-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/2600-220-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/2636-224-0x0000000000380000-0x00000000003E7000-memory.dmp

memory/2600-230-0x00000000002D0000-0x0000000000337000-memory.dmp

\Windows\System32\Locator.exe

MD5 dd20a09210d285079f0a884d0be3bbf6
SHA1 f6063b3dc3dd1358d1a1ee840c08cdd94f0efcfa
SHA256 1b7769ac042f8ec32f42c3447d65ef8d18edd5aaaa2fd61ff99a8c25d34bf957
SHA512 a62baa066e24c181e7a8853f36ad9ff944a2225c2fcbf7838e275ec01a11ffadc9ed185af3394e795692df4fc49dc50778e7e4e210e9a2452824b56955f7b1f5

memory/1700-236-0x00000000731B8000-0x00000000731CD000-memory.dmp

memory/2244-233-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1804-239-0x000007FEF4030000-0x000007FEF49CD000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 4e913fa90c60f6367890bdf18da90246
SHA1 e23f638b7ee3dc014feb74e7c56df171b797b5cf
SHA256 d3cd3bf67855370edb94ac9f443c831a454827fc0a445f8d5041364918415607
SHA512 4fd91a69c1159ccd286033e1b0bb4f758f930798ddfb30417f57cca0378806e477f0a560689594058e1d6dbf14bd7ec6a771bda65920b81beb74501d14243388

memory/1596-242-0x0000000100000000-0x00000001001D4000-memory.dmp

memory/1804-243-0x0000000000F60000-0x0000000000FE0000-memory.dmp

memory/1804-244-0x000007FEF4030000-0x000007FEF49CD000-memory.dmp

memory/2500-245-0x0000000100000000-0x00000001001D5000-memory.dmp

C:\Windows\System32\vds.exe

MD5 e03082c47ee45b9c7df14b86d8e9ba0c
SHA1 8f50771da787064da8fa356a2a4cbbf66c08b674
SHA256 9ad43c72f990f5740e273dcb5118f776554623519cb6e0ded7e27d5f00fe5d87
SHA512 7c4312192178f0fc32e8571922cfaa3bc2c6924409577b27d3691a39550a58c2410763324871ba16400e49aa485d038a44e425677d665d834fd13a5837106a51

memory/3032-248-0x00000000005D0000-0x00000000007C1000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 b66f9495deb0f5d8ad1e98e413206ebb
SHA1 37cf46d96e16b4d63c45078a1854afdc96f91e2b
SHA256 c569f4048a36ee470a8d7de4b75bad481bd475483a77682190d8216b22427b1e
SHA512 6601ba4e61e3439bcf40d9c7677bab6fc96c37e6de9dec9370e1002d2f3b3e287ea4164552df654400592222bfb71bbfc09fbbf5cf02334c18cb716cb140e16b

memory/2228-251-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/3032-252-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/1852-254-0x0000000100000000-0x0000000100253000-memory.dmp

memory/1712-255-0x0000000100000000-0x0000000100219000-memory.dmp

memory/1700-257-0x0000000100000000-0x0000000100542000-memory.dmp

\Windows\System32\wbengine.exe

MD5 0696ce212fc5199da6fcbbb75cef2441
SHA1 4319b798a7a4590c1363ab476f0fcc4f7b3a0340
SHA256 7c2ea235e0d40d784ceb6f80b37c21c28b5007cec99a5e220803988300f7afb0
SHA512 f3fa28e46385359f07040363579ebfe724d5c20c891e5255b93abc82cafb8f74f33ea3a6dcd528f3bd30643c243d3b3a47e541fd722f70c7e16ef8814c737718

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 b6df73ce9336d28de098d77c9bb0f346
SHA1 ea9e7934f8af0f71b0e6056be7c7f080310ed6a8
SHA256 161d081f2195cfe1a1324e5cf6e52acf795a6c25cd5265c0b24fc5b92d523001
SHA512 ef6a3ac131f334293295722e0329faa0a246068f094f2e929bdb0e75890dce70cc02d8d13c795ed9f7c40a2249c1da49bbfc8824619edc3509d0549856409610

memory/2000-259-0x0000000100000000-0x0000000100202000-memory.dmp

memory/1444-263-0x0000000100000000-0x0000000100203000-memory.dmp

memory/2636-264-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2600-266-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/1680-269-0x0000000100000000-0x000000010020A000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 3989a3bccb73b4cd5ad82e0dc40ba569
SHA1 6c4cc9c06e35981866dd8f4f6bbcb58b0daf50fd
SHA256 3e0c7a6d416598220bd92ccbc71a6cb901de08af4a8bc46a8355bb37c7db3445
SHA512 9bdf5d7898eb87668f862a2a44f8317ad1e8cd7bd9e064733272c16c0c90a5853b0984d2a7c29c86485ef7db1e809d118225d893766dc350917f93d05c1471ea

C:\Windows\System32\SearchIndexer.exe

MD5 094f3dcaab55ca8c46156697c2f9489a
SHA1 fdbacd72246a3e3d28b02a5e0c7c858b00600de1
SHA256 94fb93d6ad97d9944bdd384d29758f527b9eafbecc2afd850e8a16a022b4c894
SHA512 7f67544c9b9fecb9daa9e61bb3948580a83baca80c9fb9d8a7a944fadda64aa9b9d23d6aabfe28347893bcbb88abe4de60d8994843aa39de1f176b36268ab8f2

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 86f9ea1f543ed9ad5c957988a75bfca9
SHA1 cf70699e5d2d14385b9e194ed8e4d97ae9fae718
SHA256 fc48be2f19f2a58f4628ceed62e509aa14a84cfef15a9f3170e85202c9f96001
SHA512 24066285e1fa84bf59b0a4a6757660c102451a525edf057c28415f43f7abec2fde2b30346a661e19fdc4f83468c85ee43db80a196b2ed452b58e259f53984b94

memory/2636-493-0x0000000073C70000-0x000000007435E000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 26c0dcab43e649cefb492ff021f2efe9
SHA1 419e1a8ee11f0296029ef05a1e4812f681cc0e7b
SHA256 56581562eaf7e8367b66a905ea9db011cbd8f91bca9b5be3f128768f587b333d
SHA512 59e4f62b3bf379e3235f38734a26d9bcbaeb6ffb5f77dd0eb5ac976eaf4d623e77f12f50c63e4b82b7d1f817afbda1b7c8a250d27fe36dbd9b960e04154eaf54

C:\Windows\system32\fxssvc.exe

MD5 0aa446270a453352525d8184b878373c
SHA1 3522e71fa1bab7ca45d0f5e79cb5760b150c3252
SHA256 f6c7f45d587574ab42ac21729d344983306d0d24546b2f75e5deb75384ecb1fd
SHA512 db7945975484fef0bedbddf3dd9ea449178e6d796ad14a179569c31ddfabfd7df89cf2cf0af83909efea32d195f841b1b7558234a697f1bdc83092f765e1d460

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 526a65c1df3a81b5c45a36f1f25bd348
SHA1 a18c98a7ea286a1a4d8e1d5aee813062d4b842ff
SHA256 704d4be366f840cc4e2ee4f966dc6c3de60cf4fa264a2304c9aea0634c8a89e8
SHA512 dd41c6b529c602578f6ecf24bd431d1f5ae54a426c54c533eb3d69c212a36b05b4d6ddd63bebcc9cee027b4d6f6014255c555f21fad4fb5d46cc9767fd191ee6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 05eb58abe011854332a9315ea7e75c11
SHA1 9eb8ea9da8bd9bfc88acae959250ee333fe9ac92
SHA256 9302f1452c7493d038e4e85fed0936d8158af1b1c77005e3ca23925b9199bd38
SHA512 782921df56ad151f718aa31372b95d6bba098e99478ebbff2cacefaf45a8cb503a9301e3b5afbaba1b8cdb8bd6e4bcd532fbcc7abd43c398e3ccd6d667ae5b5e

C:\Program Files\7-Zip\7zFM.exe

MD5 c25d547436c6f2f292636656d4c80fbd
SHA1 395ece970e47f194c1f4de55e820a8ab9f206b54
SHA256 287d184c887fe9c7905fecfe760d1e6b57e10c3519ab93f96375c71c51972f0f
SHA512 cf8b8971ef8e2e26811f34f72d199c3367418c34c76493997f05281d6d4923e5330cc70b5e39dab02e208e78bd29014aece3c34c4d81ee52704ec18acb519e58

C:\Program Files\7-Zip\7z.exe

MD5 bf730a34846741f6e694d57044c52b9c
SHA1 d32420e1a0592483214a7ed2d66152962ccbf6ee
SHA256 b3b2c58f2898d53f47135f4ead9d389a87396d81920ea0fc30432b1b8ff534c3
SHA512 78371f7e2cff08a4e32636bd0315efed065c51bc1b6ba2acbc1021a05e54ed52c3ea1ca2542ed3ce6eac2a3089cae6ce92fd3d1f9b359180a990097cde7643e3

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 830dc5b078d660a8f796c9c694d563b7
SHA1 f8fc401a6ffec32c24b597379b160d10df9b5a5a
SHA256 5212e0a5c63fa479c46627e59756cad74c13ed64300d7a3621be15040573c587
SHA512 aeb119cc19f6c66e5281750ed106629a4a38bfbf8a67552687ebf8df07a1cd9cc06d2b488927e48acd86cec1303c8fe094eec69efe2cc19d84bbaa23022b1462

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 fe36ab9ac702834d9acdfa3db89744d4
SHA1 7a92ffaf4340a99a3287e39eeab1df03ff5c37d2
SHA256 3d63598b110e6c3344fa550659bddea29ad85a8073ba4e913a6f1987b4f4339c
SHA512 170e9632da9df1acc6a9a018946b6af2b0fcddfe0b9efce18ae8fc710b8d8538081fef3abd031fb719a00c2fa2e540f8489e585552127244918e57446f9924a0

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 17:30

Reported

2024-04-07 17:33

Platform

win10v2004-20240226-en

Max time kernel

90s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_46de8512c8446e001eacb3078ae92434_magniber_sliver.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/4388-0-0x0000000140000000-0x0000000140A0D000-memory.dmp

memory/4388-1-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/4388-7-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/4388-8-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/4388-14-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/4388-16-0x0000000140000000-0x0000000140A0D000-memory.dmp

C:\Windows\System32\alg.exe

MD5 1f7a1448865b94350ed55704811369fb
SHA1 cac85bab5b09f29db788052977d1fdbe2fc5abe2
SHA256 f77dc24ea9e7d97f059119763767d0342f01df86d9eef8eb725c8e4f0b64a0e4
SHA512 71c4dd7c22d56e368bc7fe23e5be70de0144a171920aa312cfe4f8095cee26ff8bc5c20fa225047f527b5f45eb6c2a845cac42a400a55b87c6e51743a6005504

memory/4732-18-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/4732-19-0x0000000140000000-0x00000001401E9000-memory.dmp