Malware Analysis Report

2024-11-13 14:01

Sample ID 240407-3dh1tahf4x
Target 2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber
SHA256 a70135b3bf5c57e6d39dd6e9b16b25839b679fe0c44254459cfdafa8cabe4519
Tags
ransomware spyware stealer
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

a70135b3bf5c57e6d39dd6e9b16b25839b679fe0c44254459cfdafa8cabe4519

Threat Level: Likely malicious

The file 2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber was found to be: Likely malicious.

Malicious Activity Summary

ransomware spyware stealer

Renames multiple (5962) files with added filename extension

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: LoadsDriver

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:23

Reported

2024-04-07 23:26

Platform

win7-20240319-en

Max time kernel

46s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\d4c52c45cea407a.bin C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{11EC774C-7238-4D2A-B692-C6BF59D4815D}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{11EC774C-7238-4D2A-B692-C6BF59D4815D}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 258 -NGENProcess 25c -Pipe 268 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 258 -NGENProcess 2dc -Pipe 25c -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 238 -NGENProcess 254 -Pipe 26c -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.steamstatic.com udp
US 8.8.8.8:53 pywolwnvd.biz udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 udp
US 72.52.178.23:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
US 8.8.8.8:53 jpskm.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp

Files

memory/2884-0-0x00000000002E0000-0x0000000000347000-memory.dmp

memory/2884-3-0x0000000000400000-0x0000000000940000-memory.dmp

memory/2884-6-0x00000000002E0000-0x0000000000347000-memory.dmp

C:\Windows\System32\alg.exe

MD5 3dad3e1cb36dd2f7707f51a96ac83c69
SHA1 ac39045a733601ebba7e8aade986f653d3ecc8b3
SHA256 93f59414139d1c2f074df76b20255c37a0070f95a4d4867e2796dbf2fc11ab96
SHA512 f7e925e139a080d85a0f064687569b311d4fa4dc655ee49f334c33b60ea06dbcc492c942631dee2e1d6924ddadd9be1879002e2319898c4c11a06aeda991d5ab

memory/2004-13-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2004-20-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/2004-12-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/2884-43-0x0000000000400000-0x0000000000940000-memory.dmp

memory/2004-51-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2476-55-0x0000000140000000-0x00000001401DC000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 4b144d42b73e7be090574495f6c4ae61
SHA1 3aacd11e60beff92966dea13259b136b26abfb3f
SHA256 17a5982fe2247365ac3df1733442627cb600607971872e4ef003f0ce9d72fe2e
SHA512 755baeda93a24232a894b642b79f33f40edf98be9a0f13a2c1ab6da803acc86eafab0c948d40ec24adb96e85c5100377a831bf3f0238213fccb9d9cd5f38f7fc

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 88ce0d62c8bdf226767f26c0bb890ebd
SHA1 985cc54e8d7ac11b858198647b4e5b57b944e874
SHA256 626a914d801c69f71b538ff2f0541b4a9304d671b01108c1aa7e9a2e7ea2d908
SHA512 caa99c4ee5e2218e7ec792f6d98476053173555e9ca53b074d0982cbe5637f15311e102f490020980fba28ff4aba2301873a2d31c3eeb69de472f00684162f7a

memory/2484-60-0x0000000010000000-0x00000000101DE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 2af750cade358576621e3d944f5f44ec
SHA1 9fd77e12ff6fb404f3d56804df2d34dc0bb9df4d
SHA256 7eeea1b452b22f559bf2f632e079f318e19bf8bd18d0e66dd58472fb272d0095
SHA512 3c2bf48d57917b83d7660a5227597c44fb3b88d0d79f12230dfbf54bb12abd6f3740a5e9b8e4e96dabc479fc32f4cadec8c41377b8f4aba294e5a1bdbbcf8c08

memory/2660-67-0x0000000010000000-0x00000000101E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 d783d98fa0ccdbfdefe5cf641beed0c7
SHA1 ea11d7ecb7d1d160ea632c65bf45b5edef57e2a0
SHA256 760e5741b75e7fcfa6bac1be6fada4ab084fae733b10cc1b0a4a947dd438c403
SHA512 448732397f0bf2716ff88e46012373ada47506a52e088a5e38239270bb1875a41297c6e19b039d936d1e7aa43a39296e230261d00efc489ea331df132add83c8

memory/1212-74-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/1212-76-0x0000000000960000-0x00000000009C7000-memory.dmp

memory/1212-82-0x0000000000960000-0x00000000009C7000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 5c7221f85f02c19eeac0e5555fb9d7ff
SHA1 56bfeb8be0ee1c0e196f1d3e8e4ed7e20cf8b86f
SHA256 962d8f269980f9616acbc5609514f0071692b108ce731b32107e7a42c4d4b7b3
SHA512 d5117d0a0a6e4643d19d8400fe8ea4d5aac89b03be679c3032c32c76e0fd912f44f907562b1baeae99155117c573e34888b914cee783e0c7455f48549e4c0fc8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4ad95acc117e51080a560cfdb81eb7e6
SHA1 42e2793bffa6b38513595ff40712b76e6185ef73
SHA256 38ea809ec438e0aaf62f406f8661335fac4965a9f6895586f06dd6ffb538b2bc
SHA512 c0f6a23f8273d59adf9e89870a30cd2dd027fb79b2a2df9f6a80b3228cb54a8380108a170ca647b052af13f961cf55b628fca2ae86689cedd57a0c7a54970d31

memory/2536-93-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 90fe207923f2ef71500260041f967861
SHA1 a79ab1e369ec668df224f3e5105d1c14fbf70dd8
SHA256 f356fe9d2c3ea7416869ef00695530b0af109e3c85281c1cf66105652bd6b14c
SHA512 09e6bb5cd21c8e07f64b632d713cd765596909960cf9f0720b49c57e5abd94755383342a30f200d4b9ac5209798e98f8375d7b350123bf7d2f8b4df69102ca6a

memory/2484-97-0x0000000010000000-0x00000000101DE000-memory.dmp

\Windows\System32\dllhost.exe

MD5 f21b61c5d40f01940ab3d058e6ac6ba8
SHA1 f9b27bd6d64ee6b36e046439c9f1a54a0649e89b
SHA256 0f02647cf9de9013014dbcd86b5c0b8bae87aef4332d82ca7de23feb07b7411a
SHA512 bf0209d8d15a94016efb4f0a96b886cdbcdcf57d406bb350d42e579137e4dc6f4be9a624e242817eb4b20300787f4c54af45cd8cc16b05a9be899fa4b7449201

memory/1636-104-0x0000000100000000-0x00000001001D4000-memory.dmp

memory/2660-107-0x0000000010000000-0x00000000101E6000-memory.dmp

memory/2292-110-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 6713bb56e803d65231fef45d012c80c3
SHA1 8a7c38fde7555d7ca6dfb5aead29e334dccb89cb
SHA256 a4e5237ada3060c19396fdb041961ddf51787145116373e9d8d382699e8a67f4
SHA512 dba778ece9becbc9bbd25d8510abeaaad92fc76b798fc4be8eece503de1730216dd2ebf1380e4ec67b45fa538adacf78ab725640f86e3ae1e1f2be41776b80b1

memory/2292-111-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2292-161-0x0000000000820000-0x0000000000880000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 5c7d67ca186df92805bd2302d4a24166
SHA1 8d798bacabd5eeab8c56b74734ca9b00c4a010bf
SHA256 fae03944427a02be25a4be6dacd64a0b355caade8f71ba8fc4e5a81fd99ade5e
SHA512 054c4f1ab09dfff5218c1fafe66d97996e7474f4d7e8f82fe93eb078a7800380f89c521c82ad7c1edcb1f9254782dc0150ba204b00cc4917462ae3cbe7e53477

memory/2380-291-0x0000000000270000-0x00000000002D0000-memory.dmp

memory/2380-293-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2476-487-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/2380-486-0x0000000000270000-0x00000000002D0000-memory.dmp

memory/2292-645-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/2292-641-0x0000000001380000-0x0000000001390000-memory.dmp

memory/2292-820-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 ed36b0d319098979adf6086ff5bad38d
SHA1 24ac7335cc352f32fb485b2b0e40fccc412821a9
SHA256 d250c4f2c0173803a84b727d780dfdd69b87efea0997fca21b3e0c133de4059e
SHA512 fde12ad4620a18be91a7a38791cd8f3b061903759ed4add7c4c8dc08f166362486c2acd45d32b00c4f23c5d7c5ee9c253f3008df1a65c707b681d6732996c417

memory/2972-993-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2972-984-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/2972-1165-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/1212-1167-0x0000000000400000-0x00000000005E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

\Windows\System32\ieetwcollector.exe

MD5 00c0697229a033e916dfa874b2234171
SHA1 a648a670a80c4ba57721fdf77027ab2081208596
SHA256 00fdc9bc95e6d52fa2fffa3c5a561590d8aba29a66806ddc369a9ead3170c954
SHA512 944187cad4732d7c3cbc6ba02845ed25cbdd38e71861247b32df9ff8b8018e0b7c7fdba0b14b21299452ab72c549827eb1db369ada85da6345ff6b9c8d6e908c

memory/1100-1300-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1100-1299-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1100-1329-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 61e00979743562fbb6ed8d57964a2451
SHA1 12e59898f6594be5034130e0c89956b8379e7069
SHA256 d3899aafccd4f2836ac2fe11093c0a14b64fa83bad9a2df8b73e42981876d2cf
SHA512 d1a840620e15fd0248a5082a374382339185a25e469dd91e873123d31c80cf3948ae8d592e07180fa259e1520435452b4b641664ddb689638eeabad8bd635c43

memory/2920-1731-0x00000000006E0000-0x0000000000747000-memory.dmp

memory/2920-1940-0x00000000006E0000-0x0000000000747000-memory.dmp

memory/524-2295-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

memory/524-2296-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/2292-2356-0x0000000140000000-0x000000014013C000-memory.dmp

memory/524-2358-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

memory/2920-2359-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2240-2595-0x00000000008E0000-0x0000000000940000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e059d4352f6ac0cd35e27c9c1b5a51cc
SHA1 33666228eee37dfe5092489f53ac7a914fdc1474
SHA256 af1c5ea3220921ca38473221831e261e8cafc78fca1ca15d653024fd99d1a71b
SHA512 473ad574a09822e90f54dedf5b799ddf682b94ab72c75104a8a3ab55df2a1c2913abed4b36701cd02470251d0aeb13ab33d8dd088b015f8cd38f2cf40d1eaa2a

memory/2240-2619-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2240-2710-0x00000000008E0000-0x0000000000940000-memory.dmp

memory/2380-2625-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2240-2721-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2240-2750-0x00000000008E0000-0x0000000000940000-memory.dmp

\Windows\System32\msdtc.exe

MD5 fb8d7b4efbabb387398e5ffc62b56c25
SHA1 d29f23c869d3072ba5ba0b0ef306d3ca006dc94e
SHA256 02659d4f17702d82ae0f0afa5c7ac7bc3cf530df6802d5269c7442f5ad932b5c
SHA512 538c0626b42f016eb677b3b4c0860f3c178a9394c11eb4931485735369cbff775521f18cd6ed4c71c23edf5303feef92ad7ab6b10bc2b76cb08234ed6c88f080

memory/1316-2923-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/2292-3435-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1316-3472-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 b46284f6848954b2b99d94ec98705788
SHA1 4ba38e947812555d000dd45c15c6ffe712a02827
SHA256 e05bf1e6fb8571ae9eef89abb2209effa2bef5063d5105f9b382514266e64917
SHA512 7f618aad519f587222e04cb64300556022135ebf71ed686fcab9dbed2282fb8d191b2b31f5caa9a022b60cbb7aae5d470ea6e3abd2a549f746871685380ebdcd

memory/2972-3855-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2724-3893-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/2724-3901-0x00000000004F0000-0x00000000006E1000-memory.dmp

memory/2724-3998-0x0000000000AB0000-0x0000000000B10000-memory.dmp

memory/1100-4000-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/524-4039-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

memory/2736-4210-0x0000000000400000-0x00000000005E7000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 ff8c650fac249e017bf6ae223df043cc
SHA1 57eda4f29f5d1886fc636d6be38b918b6501b6c0
SHA256 e7fd2bb48b0817ddd4cef0c5677e35ee41336c7728c640a7df8ea27ebfebf1d3
SHA512 ac98c8640c33ce9fdbc60aa17d945e232c7377884f9032dec182a4745d225577c03d25ef62096bdf1379d1b868435a412c5be69f12bd05e4d0a7426cc1a76229

memory/524-4213-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/524-4325-0x000007FEF4270000-0x000007FEF4C0D000-memory.dmp

memory/2216-4339-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/2736-4384-0x0000000000240000-0x00000000002A7000-memory.dmp

memory/3480-4683-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 35047e06b1ceab764da227f4df506844
SHA1 3b1b0a5ec4605cdce8989aac84c55db70af11e57
SHA256 713f8585496d3f1546a20a049e5bd1754f03bbdcb18185e511df1a65422b6677
SHA512 109532e56961c7fbf962220fd2327b50b092f5dfc04c8313b1b285e825cb1ba06b6f1ae7924bbbd4bf2cdbaf950dec63cc9df21ae25c9b67d816706da04765d6

memory/3480-4782-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1316-4784-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/3480-4888-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

C:\Windows\SysWOW64\perfhost.exe

MD5 44969865b7b3ae265719dd7258fb531f
SHA1 f31d57735a529d0620f4c10d460a5a6de2bfe0a5
SHA256 ad0e0f291db19605b53839781dd57b3b2d0756b5ca87f87b2ae561df1abafab0
SHA512 952739be85e621f259b04b59e6f9aa106ae51f37c59fe9e5678cd64751b2c5c6ff55c12e0b981e5682ae4d166258c64a7a3f4fd7845690c238f98da6803fcf26

memory/4108-6017-0x0000000001000000-0x00000000011D5000-memory.dmp

\Windows\System32\Locator.exe

MD5 8ed2c4d4a85a187449b8af0561753100
SHA1 1708a64e98c08c11b3aff793ff0b2b792443a362
SHA256 0f36feea59b4825e71e06a9fcfb5d7d3c4f932fd7ff9e5e296269201f0b0f723
SHA512 295c3f1a81bf45d8ace713b7baa04a885a1822029aff9a79cb292a7ed11396ac7299b83339b05f6e5c536dca19033821d4eaf6efb1ae8a08595a153db45bd155

memory/2724-6084-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/2724-6085-0x00000000004F0000-0x00000000006E1000-memory.dmp

memory/4408-6087-0x0000000100000000-0x00000001001D4000-memory.dmp

memory/4408-6119-0x0000000000150000-0x00000000001B0000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 49ae14203ae757095478513bb00f7384
SHA1 7e2e97312918a76dc767715ea52b485d79735df4
SHA256 59675ace8a5607f07bb8f387d9ee836fee71540a1fc9941e7e6ca717c92dffd0
SHA512 22cd2846d27e2932c96f5cb6d55f231c9b57bfaa30c779dbe0e46550560df3445970455bfd03198541b0f9b727636811833d5869d272b546628dc00fd6f26867

memory/4632-6129-0x0000000100000000-0x00000001001D5000-memory.dmp

memory/2736-6134-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/4632-6136-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\vds.exe

MD5 cf29486e0b62f2813d6f565c3b2094d7
SHA1 e56bd499a023c3665a7646c2bfd4765c2aa3992f
SHA256 3a86dc585d84615250510c0d1e3e57611c23552499f30547cca8da73ee0d07c5
SHA512 e72d3143fcdac624c51e8f9909391cb01961899ffe2a1803a5961e5d5e2b6e0622812081825ea6bcf10d98e985716bca626558fbec1c89e8c3364afa5ad8d544

memory/2216-6140-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/4744-6141-0x0000000100000000-0x0000000100253000-memory.dmp

memory/4744-6148-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/3480-6151-0x0000000100000000-0x0000000100542000-memory.dmp

memory/3480-6152-0x0000000073998000-0x00000000739AD000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 179514ee67c1f159719056fc5f5c8cbf
SHA1 8d90791a2fa92e79e1084d7fa2743d6e1f69993f
SHA256 dde759196c118a19f2ef30dc57ddae1602d8d2c77576a0ed0511d58797748d3a
SHA512 ff4275145b38e7b1a55f776e7b345cc48d68196df24418718a064b39c546de071460fd3205390b134d9a977038815289f01dfeccdbcf61faa3cba7dc3f5c95e8

memory/1100-6165-0x0000000140000000-0x00000001401ED000-memory.dmp

\Windows\System32\wbengine.exe

MD5 45842e7ae66d4e3997eda8ec26f00ec2
SHA1 c447667368eca1cb1b49af78535e78339d060fd6
SHA256 147505b4a5b48551c65ca1d36b31c9afd2a67dc3325a68fdfd99b4f7afdbff51
SHA512 1891d75d3e579e0fa5ce2e279de8b649cf6238fef2afad8d4e829933eb59d84ad73479ea5cec2afe771f6e199bf448f202b2c21d5602a49ec481b54864e40803

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 2cb094329bf947b6de89e952b8788e97
SHA1 75ab4e7fbcc27f4bbc1531d8c030e2db2850e146
SHA256 7ce7f0d3e7ee0fb1a6b0974f1b1362dd9f01a8dab9d9115dbe774fee33fb0c8f
SHA512 4974effdf434b376c1a9fff73944222376728e319e9821e3426b1aac36f15b31608d29f77dd65b244f6cdd2d405d89a530926fa23136288788a05d6baee77774

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 783cf9b1b6ebdf8b184e026c8b04ddcb
SHA1 b2d489093a3265598077e716eb4c25f618197fdb
SHA256 c647c59a80e7fcdafe13ea3a9fa8fcff2316fce8cdf73dd16068ac2fe04c9d51
SHA512 cfeea8734b92c72a28cd40956e6a65b2254678b0a9bf71f87f2d7fdc1e2e5bd1fd6425c40fd9ef29b15884675141904e1e15d0b81805ac9a249bf757498d2a52

C:\Windows\System32\SearchIndexer.exe

MD5 915dc01b1c893eb07aa0fd24f9c2d5a8
SHA1 b201406c6397d34040a285f8ccdeaafcc18bec2e
SHA256 e382074b662ee5c4bb161aa300398914a171c7c3254adef9cfa8d78252ec4bc3
SHA512 3279a8986547b13bd2d81676dd224adcc50b5299cca35af77ec5d72db2edcd2466cd041dcee8568123237ed2db3df7297eaf3c922d04fba2331e43d833344b8d

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:23

Reported

2024-04-07 23:26

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe"

Signatures

Renames multiple (5962) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\fxssvc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\SensorDataService.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\system32\spectrum.exe N/A
N/A N/A C:\Windows\System32\OpenSSH\ssh-agent.exe N/A
N/A N/A C:\Windows\system32\TieringEngineService.exe N/A
N/A N/A C:\Windows\system32\AgentService.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5e053ac0205991d4.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046ac73b14289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5dc08b14289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b599bdb94289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1196 wrote to memory of 2080 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1196 wrote to memory of 2080 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1196 wrote to memory of 3584 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1196 wrote to memory of 3584 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2852 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 2852 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 2852 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 5328 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 5328 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 5328 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe
PID 5488 wrote to memory of 5552 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5488 wrote to memory of 5552 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 5408 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 5408 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 10836 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7764 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7764 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5488 wrote to memory of 9340 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 5488 wrote to memory of 9340 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 5552 wrote to memory of 7444 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7444 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7444 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7444 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 5552 wrote to memory of 7444 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=5488" "-buildid=1709846872" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-04-07_1ec78ac0898f63c64eb19b0475e2322e_magniber.exe" "-launcher=0" --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1709846872 --initial-client-data=0x364,0x368,0x36c,0x340,0x370,0x7ffb7222ee28,0x7ffb7222ee38,0x7ffb7222ee48

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1596 --field-trial-handle=1744,i,13635918389281439149,15530338254803204291,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2180 --field-trial-handle=1744,i,13635918389281439149,15530338254803204291,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2f4 0x468

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2496 --field-trial-handle=1744,i,13635918389281439149,15530338254803204291,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1709846872 --steamid=0 --first-renderer-process --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1744,i,13635918389281439149,15530338254803204291,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:1

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.steamstatic.com udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 81.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 171.101.63.23.in-addr.arpa udp
US 72.52.178.23:80 tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 20.72.205.209:443 tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 udp
SE 192.229.221.95:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 udp
US 104.198.2.251:80 tcp
US 104.198.2.251:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 34.174.61.199:80 tcp
US 34.174.61.199:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 72.52.178.23:80 tcp
US 72.52.178.23:80 tcp
US 72.52.178.23:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 cdn.steamstatic.com udp
BE 23.14.90.81:443 cdn.steamstatic.com tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 test.steampowered.com udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
BE 23.14.90.98:80 test.steampowered.com tcp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 98.90.14.23.in-addr.arpa udp
N/A 127.0.0.1:52968 tcp
N/A 127.0.0.1:52961 tcp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
US 8.8.8.8:53 ext3-lhr1.steamserver.net udp
GB 162.254.196.84:443 ext4-lhr1.steamserver.net tcp
GB 162.254.196.68:27019 ext3-lhr1.steamserver.net tcp
GB 162.254.196.84:27029 ext4-lhr1.steamserver.net tcp
US 8.8.8.8:53 ext2-par1.steamserver.net udp
FR 185.25.182.52:27031 ext2-par1.steamserver.net tcp
FR 185.25.182.52:27022 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 ext1-par1.steamserver.net udp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 ext2-ams1.steamserver.net udp
NL 155.133.248.39:27035 ext2-ams1.steamserver.net tcp
NL 155.133.248.39:27022 ext2-ams1.steamserver.net tcp
US 8.8.8.8:53 ext1-ams1.steamserver.net udp
NL 155.133.248.38:443 ext1-ams1.steamserver.net tcp
US 8.8.8.8:53 ext3-iad1.steamserver.net udp
US 8.8.8.8:53 84.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 68.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 52.182.25.185.in-addr.arpa udp
US 162.254.192.71:27019 ext3-iad1.steamserver.net tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 20.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 39.248.133.155.in-addr.arpa udp
US 8.8.8.8:53 38.248.133.155.in-addr.arpa udp
US 8.8.8.8:53 71.192.254.162.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.4.4:443 dns.google udp
DE 172.217.16.195:443 tcp
US 8.8.8.8:53 195.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
GB 162.254.196.68:27028 ext3-lhr1.steamserver.net tcp
GB 162.254.196.68:27031 ext3-lhr1.steamserver.net tcp
GB 162.254.196.68:443 ext3-lhr1.steamserver.net tcp
FR 185.25.182.52:443 ext2-par1.steamserver.net tcp
FR 185.25.182.20:27035 ext1-par1.steamserver.net tcp
FR 185.25.182.20:27028 ext1-par1.steamserver.net tcp
NL 155.133.248.38:27023 ext1-ams1.steamserver.net tcp
NL 155.133.248.39:27033 ext2-ams1.steamserver.net tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/2852-0-0x0000000000400000-0x0000000000940000-memory.dmp

memory/2852-1-0x00000000027E0000-0x0000000002847000-memory.dmp

memory/2852-6-0x00000000027E0000-0x0000000002847000-memory.dmp

C:\Windows\System32\alg.exe

MD5 b9abd6b32efb6697618308cad50adefe
SHA1 654d4c86be1ce07c6fa53881fa0ab3153f720065
SHA256 2f55646350ec2c6e70c82ab4fc625d82accddce95149974d46c208055e248430
SHA512 d85509d912d2904b140394925d135017d8756340a14d4816302efb5b065d4dbb062f28048307941c725289d60787b53b9dfc4cb7a20c40d35980bb412b8c8f74

memory/2176-12-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/2176-11-0x0000000000500000-0x0000000000560000-memory.dmp

memory/2176-19-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 b6f186f4fa40ffdd288d93b13a74d47d
SHA1 d3ef148bc6799cc1a3cda96ecc6ae27d471402e3
SHA256 ac3398a2f743f1abca1cc69ceb79eb6a50f43bee97d710c52c89bb06db68aa12
SHA512 40d86e29b704f1af8e6c19d9cc452215427f39431e86a6705c6dcf7f1a75f42cdf8d816c8b7b7c06266cd46a447df90d3164baa45932215d66fb5ace70ed8883

memory/1584-25-0x0000000000720000-0x0000000000780000-memory.dmp

memory/1584-26-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/1584-33-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 80db78d910f2d11ac046ea4e9ee65afd
SHA1 090e75aecbaaab01ae2d71859492bf56e1c9173f
SHA256 b27538a5d0942d8f8581538d6e79c21a3fccc0e0df957486839c5cb00e23b080
SHA512 c096d388a625447c4952003ca7f7aa63282ecf802df13b55042bca8505ab1c5631462c5be49dcce69f15eac2a284ead1caef749dcbdf5182a91786b3bc730f63

memory/4852-38-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4852-37-0x0000000000930000-0x0000000000990000-memory.dmp

memory/4852-47-0x0000000000930000-0x0000000000990000-memory.dmp

memory/4776-54-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4776-53-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4852-50-0x0000000000930000-0x0000000000990000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 da0fed362a7019923a64707b1f63d64c
SHA1 f2b523dc1449f4a0c798442bf3e7035a62375897
SHA256 1c199b58863be5284286c14ceb1262d179c515c9002d37e7f03d5ba6eb6e5b0d
SHA512 68c3a48bedbfa2e1703a45b748c2f2b450f0f401b168de9ee571f338afa2b604e5f36fddfa7ea87165c0810f6de7378978fb9ac889ffc9765db55027069ac17b

memory/4852-55-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4776-64-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 efac0ce32467f58f888902cb76684ce9
SHA1 15d64601ac3ab5d105e10eb828261b9b3745b33b
SHA256 9eda7e589512879b206d3dff7132be4e3e78ad790b7cbbe192e0eb26db5ce5c9
SHA512 110494503a3081e96fd1d48b19b6d923c2e5b9ba60f6438821590ec02a1aa7782800a5151c34b40cbf7b7a1ef184877fa6bf30adcf8a465ecccea14bedd93eee

memory/4232-68-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2852-71-0x0000000000400000-0x0000000000940000-memory.dmp

memory/4232-73-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4232-80-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1948-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 13e202472245638c5a7da3385b946f85
SHA1 492ee2d08b130fb7c3dfff88aac6882f44b7e475
SHA256 3a62aebfac0fb8c79505858d6833031ad93e8241addc2f787c7441b695a09fc4
SHA512 6f2393e15937376c5d3d1dbe1ed49821c5bc25bf011bce634b3c429d122e6c44f9267426b129b6ec5e70f592a7fa59e1f52d73962204bfbfd025c483f1cb7569

memory/1948-89-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2176-86-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1948-96-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/1584-101-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3920-103-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/3920-111-0x0000000000D10000-0x0000000000D70000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 debeaabe57c473b30d745a4d948d061e
SHA1 db1fd830347ff843abacda1310b8dc5d4b28b181
SHA256 edb3d3af24faf7fbbcd06921c49d08371fef1cc3de8c06db1e6e082785ce0717
SHA512 8e3aa37f32bfbd495f40838b0df4398ceebe86acc211329a12a0dc9941c877d6173c8986d8e911492ba01f938f971921b4939c56d733e93b6ce3f183558243ac

memory/3576-118-0x0000000140000000-0x000000014020E000-memory.dmp

memory/3920-102-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/3576-125-0x0000000000420000-0x0000000000480000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 a2ad8ea6c1d0ad0bad369df40284a503
SHA1 af6b237dbec9bdfe40c8e9ab7386ce8b80760f52
SHA256 ca0a060f0ec0c5384c5cbc86360b495953d0577a26285235305eaa9c0d4a1236
SHA512 7a75676d2edeef4727e4c6f957b253ac12a9adb4de49118e8636a419529351662b6f5cb98f6322ac7d938af327a0a3b3b40ceddddd0f757892ea01f13f0529e1

memory/1948-99-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 eb3224878658ab97c68fb9680cc1cb52
SHA1 1550f733b75a9180b9e69686d1919ec9aba5474f
SHA256 805bc2ec89f69a44aee8bd7d424bbfb2f85eb94a440a38e423b83d903538e2ef
SHA512 a58c2ef7a57c88a12454e40b7d6170cbbf424956983ccc35f7c763137c99d3e1cc34d5c663c9ad53360401b36818eb5eda8c71cf8c5bf570ee30febaf7418cae

memory/4776-133-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1948-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3068-136-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/3068-139-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/4700-146-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4232-144-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 08fba26287cec928ad1bf92bd11accd5
SHA1 fefbe2aa58c06e819c2d250e33e1673eeac30b1d
SHA256 f4e5745710a203e97e002942fc58961fea99791955d170ce926bdbd000e83896
SHA512 8a2449d70f1d2e3f4e9b54bfa6ca58ac7e8ef57e735a0411f6510e3ea1e99f50fa533a858df2cc45ad4594c45880ed063ad8526ce57577202d8b9eec79feac31

memory/4700-154-0x0000000000940000-0x00000000009A7000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b46dde5a0adf83b046be4890a9f071e3
SHA1 b9b0a52991b1a84727ea0324951c8850b852aa99
SHA256 57788ec1886abba73d95af33704cdc3c417413b72fcc1d78c9d7c3fe795a0d6c
SHA512 e6e9f31c17a7f80ff09f1bb0a82487d69671e3e7edcfb032d43a7450abeaf13817421a674d43aa784f76ebdfb8abe2925859715d67f23f4380cd0409218995a3

memory/3088-158-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 3add7fbea0d6caec9025945dd2fbc346
SHA1 f14487c5ecc2776df1ad61adad8493ef935bcb9c
SHA256 5762c5c074122d3025470c159f339429eb0df0880b87ebc58a502691ef964251
SHA512 d05495a63a0a62f6e98d5b162ebf5a0709e4d1c8ef1fc42582bc1f1953e2b36f2ee9829a32e3b82075adabb101452ca5b7306f0a0ea962c241ada1c2eb5b5b73

memory/3088-167-0x0000000000710000-0x0000000000770000-memory.dmp

memory/3920-174-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/3568-175-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3568-180-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 9a2a6f00fab7f262929178c4bc9d3222
SHA1 053c97c4152072da0e358a295d308fcd600d3a89
SHA256 112a2cce3f25b993536640fdb019fa686f2e35fae78eb82b536b2ec162b9b0c2
SHA512 af136b6364f2fde45599b6580c58292ba29171da7f3d8226b33bc48dbd1087b0cd4c75e8758930b1763d598441e540d8c6b2356c7374a1c682bfbc41ecff92a1

memory/3576-192-0x0000000140000000-0x000000014020E000-memory.dmp

memory/2320-198-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/3576-196-0x0000000000420000-0x0000000000480000-memory.dmp

memory/2320-194-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 7f55b20ee5efc331fc755ba28d0ded53
SHA1 d3c260d80f189fe874a4ddc81a55ef7931eff5c5
SHA256 b7e20b7e4b16c35d16cb1084f797d5cb380d40924a567f492ef478868546d6f2
SHA512 937d98a7639bd2935202cc5a726419550839763da1547af147c916ccc32d7691844f591ca2541f14b2c8982de5480554c33f9961d7e3c6875abb29f92b29af62

memory/3068-202-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/1760-205-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1760-212-0x0000000000670000-0x00000000006D0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 dc5b0872d9e03a5bf5efae53b2964038
SHA1 74f114841ce32bac25429c68f276394be8a0c1a3
SHA256 655d9f17e28d7c0b64b77d6fbc9f2b517424f5e0a54170e2e52ef8d2d44a4d7a
SHA512 b64a58b6ef8ab26d90de5c3956c18d29d7608c7d087802c7368e3202c2f2c0a8d6aa03b7bba72342680a8e2d2d83bf6d350159179f09884f5c8c6be4aa04c1cf

memory/4700-217-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/3620-221-0x0000000140000000-0x0000000140241000-memory.dmp

memory/3620-225-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/3088-230-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 61618100317189baaa72da316908d3f6
SHA1 4bba1f2253c46ab901f8f9b96aea719e9930b4ac
SHA256 7df4d8e1d1cc23cb9a61908d833ffffece6231b6e2bf38e62f7818b73034a369
SHA512 b593b4e20d40b4763cc31aa6a7ae1c5c6c15a6716a22194fd80f9dd957226bd71a0b589b8ca2420556082c693187e19cd530f925eecab9d27153b2ef9749aeb9

memory/2468-236-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2468-244-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 c75f4f7a78168cce7fdf384284ef1c70
SHA1 ff1c4340b3da6134854a38831740ee97ce474a76
SHA256 850452adcaeaf70f47e7ed140bdbeb6cff0bc647b34b496f5e6de7bd0033cdb7
SHA512 8d1bfa5d4f6dfaf939f727d1181fd2e6b41a51557df25ddd5764ac7960d4c9e4bd39636e8cc8782ebd7c3a75a065772019f8640935ffa49a971cb2b84371952e

memory/3568-258-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4940-259-0x0000000000B50000-0x0000000000BB0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 320f9bdbaf9a162bbadbddb15d2a3e1e
SHA1 edfa57bdb1797f58eef16673663e23f9ca370627
SHA256 a848aa8b194dace17ba7952035772105120ff42ecfc3d1a24ed7eb893b47e751
SHA512 c3d38caa8111871f9372166ed8e597b57a294f619d3eacf65b175fbf3484b59d0b58616e820a3ad6c277140af6c0f6bcfedff566b950409d4a76b17e8fd18929

memory/3568-262-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/2136-267-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2320-266-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/4940-257-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4516-277-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 0e1731266824f930462e1a1dd6ce96b8
SHA1 33ca7d2d61c89a39977b040cfe39ebf032b095cc
SHA256 43c72b3ac88a6b52d82f2279188a645fb9a5591f6dddc39c9e2d2a045e2d40ce
SHA512 5a3bb94a085e983bfb241feecf8b753347ac599432aacdaf94fb32481dbbc2b6bc8ef7c4ca2c1b761c2ee8037daef4a4fb36c7024a56690989be240ca9878dc2

memory/2136-273-0x0000000000BC0000-0x0000000000C20000-memory.dmp

memory/1760-285-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4516-287-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 fe03d8b0a2c75ee3b43fe251948bb030
SHA1 deca12861ffcb37f8e1147df573e4c85f7135e72
SHA256 ae6faea54529bbdc878d307b5b91477b81496ebbd44588db04e6eb3b15f4a436
SHA512 9cf85314170d3651e517a441fe3b0db385beef00048575c55ce6fe9daa0607b1c3be7de0b90b88b3c1a0a17d884a93e03f59c93453266bd2f61ed43aa77bcf5d

memory/4680-291-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3620-298-0x0000000140000000-0x0000000140241000-memory.dmp

memory/4680-300-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 0673699b9f93f2517dcc49c9ba0c9311
SHA1 6a1e78d159eaf71a6010d6a739fb4191f1ac4c02
SHA256 ef29fae4b1f136df49724d476e0b763553b8110e8558542fde67835d12a17af4
SHA512 3efc55bcb9ead80fab74ec6f55d07a78195638e2353ffc74b65875171e3981736908247b18d151663451392c6a3dd070464e4acb983f9048d4f0a1b2700c17d4

memory/1844-304-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2468-312-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1844-314-0x00000000004C0000-0x0000000000520000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 f4dd337a2f65715011b10572bc1c1c92
SHA1 b4f04530c1e03253acb679819a0a8843fbd3f184
SHA256 16d5db6c565e644d0fc7801b4aa2941558e559bde99f90b3d0a6ed99b4577f55
SHA512 ea04ce8def89f63cc44f2b72bea7cf50fd6384d7123db49835d967d26e8f4fa7cc9186ce0c98e651611463455a0e2bba9c54f8b2190de6edb376f4101cfac613

memory/1196-321-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1196-326-0x0000000000500000-0x0000000000560000-memory.dmp

memory/3568-436-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

C:\Windows\system32\SgrmBroker.exe

MD5 2107e01795e096b4b183b5925697ef57
SHA1 28e18a894b6b071758fee613c6400b54163d32c5
SHA256 68429d594dbd9a7f8be8fa3d114eb843fc07e2c9f558a32fc5be17f146182cab
SHA512 08f31eec60dcb138260e95d98b391421acfdd4e486d53c356048e80f982cdd32ca240c6cae357c85bd1ef5cb463b137b365e581ef5d243cac6ea9317f3a9e84b

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ff71db12c6946d5c105cb8e421abd962
SHA1 cbf0f6687dbadd8ec133bc8e20e8c3eb5e6ba178
SHA256 db94ed8c7721e4ec7342572e1be7bf896a20fa477285dcda2b38c627329223cf
SHA512 2baf9b776246c866e43f96ef131ed7ac3124d8dad3b86f78b537ce00f5a4746217d986e56a7493015aace2a7ba1d6f70cb71fdf27d31b7a21a81112cdf9bea13

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 8f2f216795fee2a7ec57bfe959ecf7e0
SHA1 ae1272ee6994deee424f1726f6c087e0f9841a52
SHA256 7b8f91542b2a8159141d9bdb90f715b59ab9de90db5f876b90c6b14223ed477c
SHA512 fc33d372bf689b9eb47881a9f0028ae2b7cc681e64274eb69be518004d451254cb41608d628bddb8a4545258300b9c4dd53559c3970e164bf017b4af7e0cd002

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 6c9c28b8e573ba862ce961dd20b23bcb
SHA1 ff57f05cdd24a6cb7fd20f5aa7d04c8c94d2f05c
SHA256 6bc22f9f1e8e8c725277082af8566e2acb1a2fe35ad9cac0814b037f93e087aa
SHA512 647b4a671b8d37a5a2f934144e5db4c025a5f230cd84a63dd32de3154dde322daf83ace62f4fb2eda114335cd7ed2abed132dce860195d9199b1a35f25bd705a

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 1a9882fda4ad3acc1e6c95463a9dd685
SHA1 c0f3decc5aa609ecba51ee7c8372898c1d5a8b36
SHA256 6039eeaaa79a56a2146efbf736ab3dbdd63b8948cddaa7d20ab7a36af84c0833
SHA512 6fad8533af301cc8a7d9d0a56ae56f47690afb1374c361787e6afbf8ea47ae54f477d1426aba0cc2d7761c33e0b7ea02a0ae8e88705897dde89a24011f090db4

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 7ce7daa01e57050013a03bdc3d9bbde6
SHA1 a66a403a3a6857d63c0e13dca6862ac1bc037f88
SHA256 34c1cf21ecfda6020d742e317039f58c228eba61e0c7a4aa3318d817e0f91c8c
SHA512 2751c38317f9f70b9e91bdbe6b7f7a2dbbff774c76a92dd2e7687b5908585f743fbd66d10a713071a562c70c16c0b19e536e00b4fbbf8925a2ccd3fdbf378033

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 eaccadcb7a6cbd9db4e8c5ec41998f50
SHA1 038e890eacf649dcc4d7185e9e7dd20c1942621e
SHA256 457ccde0e01dc70a2214ffe65e7e7ac45607a42e8b21e9ff3eada40db332c07a
SHA512 3822afad1884057ff28202a41bf38b32f9a651b4576ec6a88a48e862a56f97be75da3ccc18ab84290d670aa7dfa302cf2496ac4f52ce269138be52e5388c3ba1

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 a7e5d7cd897f06d3fd88b5e6c787182d
SHA1 925231f94ca14b8ab290dc53622ac22a972e29ed
SHA256 9892358337f613bd2d977e1b460c535831a3af7b00aca3e59ce0d249cb0187e8
SHA512 ce87a6ce18609df958e4ff21784348a707bd0a340a251c2ed4519a6021645e2976f9f7c7b4fb2e96bc9f704ec359adb9ec2af0ead5aa09c1b05d0fabab4e9ea7

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 cffbf35e457b99e7e3ae4a204d7e7dab
SHA1 e9fae35357d417991b82af705c7e56591294f53d
SHA256 2806976592cf59b24695257c583e21476d16f2234e2b812b3428921c1099e230
SHA512 243e0a33705fa71f32c93a90e9998d44cfaadd80cebb6b79c3db8cbf33da3f45a3ed20d28956dc0d12f5a66d2038252ef9262d22502b81e67fe195fb7ba015c0

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c211f95d2107d01232efd3bf5345bcdd
SHA1 4dd0b2ab15a007fc19565deaa52259ed4d169876
SHA256 4d890f7f9d806b583a518f0dfba95b627f2f9eaaa3f86a2227d78b1ce76474e0
SHA512 96dadfa75540eba1683338673c8cda954dbd331f168684ccaf3ea6a37ad5b014706532ea11dce16e74cb92308ce79457fcc2d968306abca915d9112eab654e3d

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 b94e7a2526765958120b2c6adbf2ec96
SHA1 f8ae75892ae78deaed1fdbcc277e54a3385561a2
SHA256 42b8e350bff0126a28acc3bfdb8c7604db4555b707fac7524a6617f9e21b2cb4
SHA512 1bd727646ccabbd315e11931fd6e3fa0cc2fdc353f0843af5f39a43bcee06cd6aec522de02d76e9ac531423a50940c81ad75dde668bcafdb0a6918bf3fa81a41

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 4849b28e96954691169aee2e1ae7ee8e
SHA1 c7c9a63d2cd64ff656811934ff1145b4ea2ee183
SHA256 4b121c494ba0cd14003d523023c419e0c9ca0474cfb5dfa343b0d10568fb8019
SHA512 3ff9f4e75f1a33d240b5c61301500c789dc05b0ec5aeb365bcf50f10f0ffba67ca47701cca5bafcb0df82e7b2752870948d4b78cf5add4590418c9442ad388de

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 8154cc173bd4be97d2f057cb260c5f67
SHA1 8e60055122df2dcdee224f467b65aa19c9dca289
SHA256 22722e043e62fb226b42dd7d2efd71d957380325e689dc49f9d9b44c26c806a4
SHA512 cd42e98ec53c7eca1ffa74a9cea0276873efce8a8db9dccc886401e5a0ea002efca3dc2a4235787edba273f5bad19fb442279df2cdf246e1d023558e9ff8d804

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 5f8aa6ba4b3b0b5d17dd64c6568253a9
SHA1 32fcabc99b958d3a067f94f52c0dcb7b2497a748
SHA256 df9e7e456d1f919ccc857e8ea5e9e0893f77293a249f7237d9d0a58195c16ee7
SHA512 509f6cd7f91224b870a780f14191f431800aeaa1a4d2fa059c93530ffeaadcb390ac5ccec608ec575b117fc2ede2c47e827322b3fda762ea38b77cd6f4fd364c

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 816dc862e7a971f19fe7a7632b8cf3b7
SHA1 e0c341953c157eb056497b1cc6604bb15b855c3e
SHA256 dcffaa5b6fd761744c759ca00520ca678e869e1a4e5f46708adb94bf214f03b9
SHA512 16601fda98abb625a95e0b3c62a8673b0df9c41b519109a3d1576daa96df6bbf854f9ced368bb662af225252a6f67589d2943c3afde13119694428ba03a96d14

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 11072bd4f1ea6be3ebc8e508d28c58c9
SHA1 7761684c0557b4f10d9f2aa23615db960335a099
SHA256 a6175907b982cc990fe1a201109c05fded777a3703097b7f2e697ee1710d8a20
SHA512 a27d2f8510c400594ee3626c9534328aa7a7ace3e09d43a9d1182e1fa26530d35338bc67ff67c111edec348a9bbde337e1e92d46ed7a7b9c3af773719885c887

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 f7771a4a4b3b5e4641b2aedd12de83f2
SHA1 ae3f0785104a95cb6bf529b6b68cac1aec1ab9f6
SHA256 2cf7dc2698991b5da945cd07d5781ddbdc447e53e5e13c02e03f693cf027cbf1
SHA512 c338d958d992fcb522afe20dc731d64a080a170f326f85d8a09eeccdb42db80437a345fc4639c13ad5ba6290b722aedaf51f4704d900c90e3134d4378cc7473b

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 306d74307863e6158c5238a808110e06
SHA1 dd0d4eebcc594c3dc5c0a9fe2b795a9105f414b9
SHA256 a5c880f780eb66c46e398560a67be1ce96f1778dc0c39893e4ffa303ccd96408
SHA512 e2bedc29a12b45d2829a07620ff4d283dcc210f4871a87ec3ae86f0fc070fd658b9ecf8dfe370322dc9609c7969d03b09d5dcc36b17890f194b6a885da67b4ce

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 82e8140449dfb563e95fd40346af45b7
SHA1 a5227c5bc8c17cca92f72f2a277e02df90cd88a1
SHA256 6814f165ab49d840490a7faf84ee326cdcbe734bd4f806801bc0fcb7ff688d6c
SHA512 87e129448e5ff059ad5ad7026100d2af50ed94c449adf4abd3194440b37816978d72214a56896220c526562bb2e48560dc5517de70096c314e06fa0ab3659979

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 12203d3c0123f8a0503900ac0b158779
SHA1 f08fb785f8ae6eb3aa7a99f2a6c97f74864b8e77
SHA256 fffb512772ef64d06c4eaeea6f70623e9c98d4edb4a2a0ad3eee233ad23e842b
SHA512 ffa60e7d15466c4e3ffc35590594020132352917d34ed67da65a6e99ecd635a970b360e0e756fc2f303ecfd07f864978d603bc0115a6c9fe35c6de2c0f617650

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 fb47f4d034cd8e3b7ac836ea16e795d5
SHA1 2d30559daf7f3a6bb2f9e40f5c6ad66a262e5bc4
SHA256 1bb0be4913d8e2751f05cc39e016e540808a6a6def08a8eff563f6555ff3d483
SHA512 078d3bb3994a646f914aecdc35f5f91276852a31a0f7d31bf26568e2b0d0cad92684574ea25890e07d7bbadb87813239413b403e23263c929a820af91ff2aa92

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 266d36d72c4a169943fe0e37bae4768f
SHA1 36884cfb469fef4fc4be1f06de9da2c14c637eb2
SHA256 c0d068bbac19149d128648310addcd44661bc41634e475bca02fec21de9df9ef
SHA512 aee6837a8b7f61dc701c457e66e69b077b8bc8dfaf9329684184ec4737c6b5f1dee644d4f617673e21f9fa728603b0013821b6e78a99be6d669caa5433f66627

C:\Program Files\dotnet\dotnet.exe

MD5 abbfb729a06d3714b50ed8dde622eabd
SHA1 81bb4ee1eac61a6e3f56a8f915c743e7f0845069
SHA256 7bb0a2be273ab0a514779c2b8f6245500154c89895e91fc9041aed6ccef5632a
SHA512 a73d2d61327562fb8935006451e7d4ae83e71795305e36cb10934d13744a41261f4cac7f21da222372c7cbba24b74e02e8c098315809e9856ca97e8cf4c59dfa

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 ffff009710b02c68eebb927e9975d145
SHA1 fa6fc1d283503713c5b259633fe11b724bd962b1
SHA256 5f1ab6db231da8eb05fec9f49c2895133f11feb66c6303d67da1843004a9d52e
SHA512 c89f816277a1c9ed09d922448a028aff750a2fae7b757d3ca6cab809d813d9f3f8241e75cbfc53bef23e36c574d8ef8bb84d561713dfe2b3239c347950ccfe7e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 81c11e5baf4e1c391a44ea38acfe93d9
SHA1 a9e49f8251a2bb4c71b34edbb2a0945f0ad9462f
SHA256 fd2c36350362fe67e4a653f55a0e1e053787e7bd960e24b31d750763357cb275
SHA512 279709f6558899e518df11a9c6e9fb7f976284f6d0f87da4412392e10f987b8c80c64a70ff8a4a677ab0a5b7ab2fdcf8c3068249b7ef083f193910cd5daa5fe4

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 1309f3d02e68351240dc5f39bea09d7d
SHA1 ce64d3d9ec351d01f3f7cc6c7b44a245385cc149
SHA256 ba57add183d3bf9b411633cb8b88089edc294b77ad879a297662991b83eae736
SHA512 8b33e97a25e6bfeec4d5686b5a1ba3ad26fd407dbea26ff386516d27398a3ae58ceecc41520e96c39bb905ced09b5a9c069d50fd3b365093d9ec16cb973f022e

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 7008bcca68a1357e8e6a86063dc60f74
SHA1 e952dee27baa79e76a3d430ada5942ebca7ae812
SHA256 dde1627d9ebbf88409368dbe74bf41b853c1218709bd2bc508ed3e2a58158d59
SHA512 a1b64b3a09e565aa7271f84cbdc1d7b136063f965a282ac244235798cf08fdd05430c68088bb3b158d8b3b9c7604490424ff89581b2c5c5118f913e3ea6d290a

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 f2a86dd04397935c3827e1f658c7d3a7
SHA1 274ff3db1846994005d519ec2c4e42db24794476
SHA256 ce54141e7bab645ac03986c6bb9e3cb33d9cc6e3efa88990da0cc9ab39beb4f4
SHA512 227e9298bbafe1f062a8a8edd779684d720c793aeae2cec32ab0f30af9dd150870839a4765e82a0705d674bea72192ca889d7a8237f3af56d479a78f224e340c

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 debf954ccf8727f9750ba54f8f97974b
SHA1 212e7b0cb9fd7b509ae9527234a23aabbac228e7
SHA256 554bb15ca0c94e1622715a266d71789e9ed0fb05a0d8d0163b46649966db4bae
SHA512 5361aac2253615ca0468d9fcdd15c514e6d4e4c8db7e0fb6f265f30ef656f3f2907ccbdef761a91c8643683bc4b0f99b539fe2fd395d66050cda2d50fdd4a968

C:\Program Files\7-Zip\Uninstall.exe

MD5 7471d981e5eff4d1442335e5fc078064
SHA1 08d762592b36916aecb5f254f6d8c3ea0821cacb
SHA256 e847ae4ffef40a3f61e19f1bad5278538673dbdfee8eeef9928053622a538248
SHA512 d83924c6f06122f8f59fa8946fa77e257322f5641e4ce9a7bc4fe0b5976a1ca0c1d842a866e8218150a543a8375677314c01b4b4da62b6a80af2c580bb8d25bf

C:\Program Files\7-Zip\7zG.exe

MD5 b3082cb0313a1855b506610a209552af
SHA1 43f1f276c5f4cf061a1409796992ab4510e81e3f
SHA256 fdde705b0b508e9b4eeccfe4e41ce7fe36cbfd2b1d1855948933fb1ab6713f6d
SHA512 242fbca2bfbc9fe4268151ec3606b76157db8fd06a5b6dcbd4c1b65380c7d6cf8cf9fb1fab0e1c885e6f10f73df38c93cbd3f063e1db0de041bd21c47062598f

C:\Program Files\7-Zip\7zFM.exe

MD5 e1ba5a2564779875be0ba6d6c25b9fd9
SHA1 01b69b498ee6eab84fa64c78ca3354c690544d9f
SHA256 8706deb6bb0c2c33a674b18c692b6b1865c6c632cd5340fbc46e9ca009d03d4b
SHA512 87f64cc35840f6bf08c4f56ac97799b6ee369883d2d33b6b57ab4abb4bd766881ab76b6f34db3be58e10242e409837ed664e3a97888db9640e44c634d01c5832

C:\Program Files\7-Zip\7z.exe

MD5 90224d5d5d99d6e1e50dcb531280b78e
SHA1 3d23ff5c82264108589e9937af929d40eb3e2279
SHA256 4e53eb23fe539e5a33b8614cdef770218a3bc723014c7d3ead16f312a449b4d8
SHA512 891dd98c45c5523673a7879dc96bc917a80a7b1f119954f1999854636e251d5ff5ed253cbe9c3cf339182d24add6d4c35c82c803abc6d207337d2aa0e85f2e51

C:\odt\office2016setup.exe

MD5 da767e14de33a7d54c9051f150237e75
SHA1 c01ee4ea3136c1ccb2f400837c6f54bd16979622
SHA256 1c80da0beeb503d0bd692dffb5fb95cb7cef8cc842d8be82d44750b065432f64
SHA512 8d59de3ad5cc2696dc1659721ddac78b7538b7f627117c98d5dce81aec084c6d3f571107272d0a5443aaf597913a7a2380fc35f563f4fdaac5d1a1b9037fc510

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 8b93074ea45fe76fc2ce77ecfb670697
SHA1 8b1aaea79171cd77ed190e23d232215bcc8101fe
SHA256 5ec88305a5b36c4b2144b017a93205981c1e495ba4d691ac5b28cf8aa2f9193b
SHA512 31a80726898c8a1f4ea75e18a567548b987378c557629d42680cb61f17402af20dfee1322e431b3440913bd2e69a1eb0da599dfbc5a0fe560954fac2aeb5d3fc

C:\Windows\system32\msiexec.exe

MD5 ab45f8b967fb1f1f6122c07e73d6b9cf
SHA1 4a815c7c223e77351c40f5fa03f768634604b975
SHA256 03fef8b031f48fe0f1b9a713b02c72c6d4ab8069b282c6720924876206ce301a
SHA512 41981bc152dc6004d9d55bc0d809380ee605b7c27efa61f8e9438a5b907446d50c8686f1108347b0913cb3afe049e3c0cb3b17627b79c7cf349c0f49a97f5e73

C:\Windows\system32\AppVClient.exe

MD5 7b3c3f569b25a026da6716df91cc7e23
SHA1 37972b11e2693edf74e1b2ce54f41ec192483171
SHA256 f1c5b8512ebc3bfa57ed11e250f22f942f480f438d95549b911df761a431eafa
SHA512 2bcdd2b522688d4c5ee750314b73d88505b7608b5b66f840321d42b94e473685bb1abc8c83251dcdfe759eb0663e8a453a283f99ca78ec7493836c0ada0ffbd3

C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32

MD5 efb6e815a83a9222a7263e78209285f1
SHA1 e178c8468d4e2ac9e66e7cd597813e6d85b30044
SHA256 9d0a3df457493d2ac1dba90a89ad6b35d309951142c793bef247ce462a631a2a
SHA512 36b1ec5f4b045b026f80983f769fa20d9e301c6ed92a036629f768c13515393522123d6436f438fe4f24f9116c0c7908c4d8093fcca36972e12ec763a06e3c72

C:\Users\Admin\AppData\Local\Temp\package\tmp\steam\cached\game_details_header_green.tga_

MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffBottom.tga_

MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\cloud_localfiles.tga_

MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdBottom.tga_

MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_tray.tga_

MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync_posix.tga_

MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb

C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync.ico_

MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_schinese.txt.gz_

MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe58a11d.TMP

MD5 402c3ead80f39a55d453be2125b6b1d8
SHA1 3eb63f8f02faddeaa480d171f7b1e0b0f140a32b
SHA256 ecdeb5a7d9209dbec7e50247dd0f4e90309e37bafff1fda70b48fac06fc53be1
SHA512 d21b4ca26ff18766409c7a0eff882c72a79518d659ec016053b859f33437f09cec6f20257f9073aad4e65210d7b562c4a211ee3458f72371c2b55299bcc96268

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 3c41b09e10e0e54b0431f56ff3429270
SHA1 237370fc3712d338b618d9d051afe4203958ff12
SHA256 0682184a9b5f6dd9c90b400b618030a8ceb33d019fa3da0f4aa17973b74fbd57
SHA512 ec95e56a2cea2f77b27e584505a5a778cefc585789fb8727edf5675233fb4fb928b606b22fd552236ff1a7a7004d097ed87b5a31a1c46bf72936d7a36e09a162

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe595c4f.TMP

MD5 86608b2422c5b9228223a2a6fdeaafff
SHA1 6a7a9494d9cffde4da092fd35e54edeca09c933e
SHA256 8643c37dc037f301505c7891fda41a869f19fc9338cabd34042cba5d42082a8e
SHA512 2900af1ac084a56f23dbc1b6076bf30c385f776962753dd3de4357c008137e33e24e2640af76cb2966a3c535542e4d9d1fbd48f301d9cda7dd70295c2bb664b2

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

MD5 dea4caed5dffa473e7443ba0c84c39cc
SHA1 a6965b25a962752da47a7f20ed9c124c11cc9a5a
SHA256 d91877c64b9f5e3ebc32ef9b8a038607def927587be649da5358b72903c87cf5
SHA512 e77c1664163158c89f7c07c8cafb871cb1e61b2805855ecfb838cca1139dae775bf4a0582d0b2d1e0c79e557902f8d12b3cacb60b3a149069c355b46406643db

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 31f5d7ca5792f1081f45e08868ca909e
SHA1 ebd8bdf1ad381773dd1d7cfb8876923751fb2cca
SHA256 33665274bffbb2b7003b36eb6fbab01d3cd3e77aaf54fb180260875d2ae93fd0
SHA512 47285f30f036545abbe74ee77e7fb8c0d369195c031c3694b2711142571bcda813f973cc420ac3c956ee7815acf41b37f86f69595de26d17dc4b4e02c2980759

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe596fd7.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b