Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe
Resource
win7-20240215-en
General
-
Target
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe
-
Size
8.8MB
-
MD5
b787f18cce3f3e54093534561c545b8d
-
SHA1
8e0745b4291c428fbf38323d4a83e504dd796ce9
-
SHA256
b1a40a1cabcc7adb2c547b1b0639b8ab7fd6d32d24ad8b2e1c3597a56a5a4371
-
SHA512
6e49eba7248cb3aa7d1e69e930b165df6b35659064c2ca029549fa066e9cc8d6782cba7bba427c0ebf3c1b08a04b28c5a55430f9645f17422e111899e3ff5fbb
-
SSDEEP
98304:EmCMLyAw3LNIsVqygGP0w1sBJ1QttoFCqkKq7NO55f0pmsOWrqufezvWq/vUv2TD:8JBILX6svTCZWfFWrqufezvWqHUw
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 27 312 msiexec.exe 28 312 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exemsiexec.exedescription ioc process File opened (read-only) \??\Z: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\P: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\T: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\L: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\M: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\K: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\W: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\U: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\I: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\Q: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\V: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\O: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\S: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\X: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\Y: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 16 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI24C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2951.tmp msiexec.exe File created C:\Windows\Installer\e581e31.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI275B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2AAB.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe File opened for modification C:\Windows\Installer\MSI26DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CF0.tmp msiexec.exe File opened for modification C:\Windows\Installer\e581e31.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2B58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C72.tmp msiexec.exe -
Executes dropped EXE 3 IoCs
Processes:
lite_installer.exeseederexe.exesender.exepid process 3032 lite_installer.exe 2120 seederexe.exe 5648 sender.exe -
Loads dropped DLL 9 IoCs
Processes:
MsiExec.exeMsiExec.exepid process 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 2280 MsiExec.exe 4308 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
seederexe.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
seederexe.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached seederexe.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000633d4c322799da01 seederexe.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Processes:
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exemsiexec.exelite_installer.exeseederexe.exesender.exepid process 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe 312 msiexec.exe 312 msiexec.exe 3032 lite_installer.exe 3032 lite_installer.exe 2120 seederexe.exe 2120 seederexe.exe 3032 lite_installer.exe 3032 lite_installer.exe 5648 sender.exe 5648 sender.exe 5648 sender.exe 5648 sender.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
Processes:
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeIncreaseQuotaPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSecurityPrivilege 312 msiexec.exe Token: SeCreateTokenPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeAssignPrimaryTokenPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeLockMemoryPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeIncreaseQuotaPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeMachineAccountPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeTcbPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSecurityPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeTakeOwnershipPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeLoadDriverPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSystemProfilePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSystemtimePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeProfSingleProcessPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeIncBasePriorityPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeCreatePagefilePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeCreatePermanentPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeBackupPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeRestorePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeShutdownPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeDebugPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeAuditPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSystemEnvironmentPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeChangeNotifyPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeRemoteShutdownPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeUndockPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeSyncAgentPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeEnableDelegationPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeManageVolumePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeImpersonatePrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeCreateGlobalPrivilege 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe Token: SeRestorePrivilege 312 msiexec.exe Token: SeTakeOwnershipPrivilege 312 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exepid process 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe 4616 2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
msiexec.exeMsiExec.exeMsiExec.exeseederexe.exedescription pid process target process PID 312 wrote to memory of 2280 312 msiexec.exe MsiExec.exe PID 312 wrote to memory of 2280 312 msiexec.exe MsiExec.exe PID 312 wrote to memory of 2280 312 msiexec.exe MsiExec.exe PID 2280 wrote to memory of 3032 2280 MsiExec.exe lite_installer.exe PID 2280 wrote to memory of 3032 2280 MsiExec.exe lite_installer.exe PID 2280 wrote to memory of 3032 2280 MsiExec.exe lite_installer.exe PID 312 wrote to memory of 4308 312 msiexec.exe MsiExec.exe PID 312 wrote to memory of 4308 312 msiexec.exe MsiExec.exe PID 312 wrote to memory of 4308 312 msiexec.exe MsiExec.exe PID 4308 wrote to memory of 2120 4308 MsiExec.exe seederexe.exe PID 4308 wrote to memory of 2120 4308 MsiExec.exe seederexe.exe PID 4308 wrote to memory of 2120 4308 MsiExec.exe seederexe.exe PID 2120 wrote to memory of 5648 2120 seederexe.exe sender.exe PID 2120 wrote to memory of 5648 2120 seederexe.exe sender.exe PID 2120 wrote to memory of 5648 2120 seederexe.exe sender.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_b787f18cce3f3e54093534561c545b8d_magniber.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4616
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 773EEFAC274011E62CAADC120CA2CC972⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\DA8DF076-7F64-4019-9F10-0360FDD0A8A3\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\DA8DF076-7F64-4019-9F10-0360FDD0A8A3\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3032 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24E9AD4057F19503CED5BEA6648EB6EC E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FC6DA976-D840-408E-BABE-DC5A757EFFF6\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\FC6DA976-D840-408E-BABE-DC5A757EFFF6\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\073CE3A4-4FF4-4826-B6EF-19DB3C227E66\sender.exe" "--is_elevated=yes" "--ui_level=5"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\073CE3A4-4FF4-4826-B6EF-19DB3C227E66\sender.exeC:\Users\Admin\AppData\Local\Temp\073CE3A4-4FF4-4826-B6EF-19DB3C227E66\sender.exe --send "/status.xml?clid=2307716&uuid=99cd3152-f6a4-4c9e-9fc9-df953876db71&vnt=Windows 10x64&file-no=8%0A15%0A25%0A37%0A38%0A45%0A57%0A59%0A102%0A106%0A108%0A111%0A129%0A"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:1028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e581e32.rbsFilesize
591B
MD534d1e441cf5a9b8fa56e84861f01da5e
SHA194ed978f8261f9c85f4557d4bf094418cd3e7d53
SHA25670efdc3982fcfac9f270f624f3cf7da64c6ef50d28a76cb097e412d193d97be7
SHA512b8358c2ceed4f0c9f1ce1a8f193d57ce7f1b40139f02f0bf9e7450a522a091ca64b5a0eb68a449f84ecbada8bcaf04de8d5e2a42c80edca48a35afd2cc5a5d6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501Filesize
1KB
MD5d51332c4498a42803274c8934d94c9d9
SHA1c74338351316938b5b74467e7574e7dce8f3772e
SHA256e241e6464c543009cd33ee42d029e6e3dab9770c37fd313c415736ce8881bb58
SHA51210aeb818f56a839a25a5bcea15fe2c924e631a25b64978b3995e0d96ad0f20c2eb1543ed17c59285b7267f8ac2b7b692deeada04c683cd2f4bb16db40a379f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2Filesize
1KB
MD597c39fea884a0ad69fd4ad52d7670c2b
SHA1314456ea83fced57372db666a97d736b9ebed3da
SHA2569dd023df04ad5eccfbdb943e9999300f890c412e03ea0152aaabff82538a1cc6
SHA512ad7b528633df63f152ad13ad09bec632f0e629e99ec73c981e0cda2f3abdd6e08aa57a2fda8f7be8ddc255a72dfdd5a195dac00066e2939c422deaab203bd9c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4Filesize
1KB
MD53219ded8e6bebcf9766fa895a512e2ec
SHA19b46da19a2f1f10ff073af24702610d365fd4d51
SHA25640c8cb562259f2a9e18f1fab2203b317e392ae4489b126c841640736038bab02
SHA5121dd91fc599a997b7ba7ab1f4ce3078358c2ea3b0495b2af4e97cde761bdd393beb62c891f736e83f036715033c7d9b2eb61a102aa77edc47c9e0ec83069089c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4Filesize
1KB
MD52ffbdb98df2a2b022a48adeb94a3af50
SHA16c86923b5c5832bb102f041cb7d38db397074f12
SHA256dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd
SHA512a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501Filesize
508B
MD597d49f6df2e1ffe6af103592c1815b84
SHA1de7b3da949a57e257a790d3bf59ccf6790c50bca
SHA256ef253ad351cdefb3d34515b5632717143a4a9dfb27ce271f48198e259d9a8f15
SHA512929462092ad0dcf9eecc3e60d514200f2b38b07476115d6bd53ae855f45b2ef22ac8571a3d3ef3e487e1ec14b9ebfdc06f865f2c3c000fef3a2fb4980e9e303e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2Filesize
522B
MD5cac5eaa9e4b751f159667931e34c1cd4
SHA164e5eff1f4e0f889337cfe561fcde8cff132e4a4
SHA2564a9da7c6250aa642de02a389632c832ebf8815e7ae8d5325106034161e681760
SHA512763275da470d7f1318b67ccae24cea29bc8fe0db2aaaa5bcdea801ca695c31ba8909ce6b8a25c8672811c20697b25b46be42ca9367166eeb95b6269e93e04862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4Filesize
502B
MD55d26ce3dc39cf396f7ffbf4f14848ae1
SHA1adbade8a16be5b85bf4ef9200493d5e6b2fa0523
SHA2560685ac2dee89bcf2fc3b0412c302e403e1c4cfd674ba92beb97b134c84be83bd
SHA51274b1861fdee5cfef7175a343a9d39366948eaf65526475d3c289a252af61d47dc6fd678f5820f01ad64231ca792cbfd4be2d6f200e46646770019a5455e0f861
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4Filesize
208B
MD51833cd80db4dc83b86e3db7724f19df8
SHA1fc1c1d78af988e5724cb3f72b9ce97ad868bf335
SHA256f8b62d300d299f4e36ae741ca11b82e4f33b0fd2e7bd4599b73a469752c1dd3f
SHA512d4f3ef3a7b664ded7d2f541555b0be2142e384d7c9deaa240aba3c6b4530e7e10a8ddbe140c40e018b6539e0a00e96b2af752a5dc8f3d92995cda4274def3eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0Filesize
440B
MD5c0bde90deb9749e2d7898e8c42636ed9
SHA14d394b0533a7ff1e0dba078786d5de8510255836
SHA256d2e733dc89dd044cfe7644921bb347b65d2cc427248f7fbf90f5bea388166f67
SHA51289ee131ab897f3558ece85bb727d79f362b429ddf4622ae01cf007d424c458d7994e07888c2c1faee79c7f9690f146bab4561423bcb09e48748c097eb035e0ef
-
C:\Users\Admin\AppData\Local\Temp\073CE3A4-4FF4-4826-B6EF-19DB3C227E66\sender.exeFilesize
249KB
MD54ce9460ed83b599b1176c4161e0e5816
SHA1ca1bd4f28ec3e6f4b0253764e6339e480d3549bd
SHA256118d277f46df036ffb1ca69d9da7890c65c3807a6e88248f3ba703b0f51cd308
SHA5121064da56e85d3b0c34c47e9fa0821b2ceb79e338e602e705b7f801c0a1bfb83246c340fa1351fc222216a12968bcc52540e105f186a3ef6f3e7c32348936daf3
-
C:\Users\Admin\AppData\Local\Temp\44782188-b51a-4a16-8360-695c60f28959\[email protected]Filesize
1KB
MD55a40649cf7f6923e1e00e67a8e5fc6c8
SHA1fc849b64b31f2b3d955f0cb205db6921eacc1b53
SHA2566d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a
SHA5120fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786
-
C:\Users\Admin\AppData\Local\Temp\44782188-b51a-4a16-8360-695c60f28959\[email protected]Filesize
688KB
MD5ab6d42f949df8d7e6a48c07e9b0d86e0
SHA11830399574b1973e2272e5dcc368c4c10dbbe06b
SHA256205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2
SHA5126c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5
-
C:\Users\Admin\AppData\Local\Temp\44782188-b51a-4a16-8360-695c60f28959\[email protected]Filesize
5KB
MD5856242624386f56874a3f3e71d7993f4
SHA196d3199c5eebb0d48c944050fbc753535ee09801
SHA256d86ed80d2a9e4e1af843a991a6553a2fefd5433b2144be0cfb63a2f18deb86be
SHA51276d440fe2ed535677a1d249b289463bfedfc5d2afc0e269e4593bb113393f165856c07117735cf3e5a230b5d04a61c7126df24a466594d8c27b47b2047834a09
-
C:\Users\Admin\AppData\Local\Temp\44782188-b51a-4a16-8360-695c60f28959\[email protected]Filesize
1.7MB
MD5e68cea8c6d4b16641f30dd930a952ebb
SHA17e8c4b51e6e56f35a2983ab6cb121341aeda565c
SHA256a7f3f788323a12158d66f341c4711d71fc2244a2b07a68fb8df4baec0ff76f35
SHA51296351e36a4c5020ed464b96b72bb3063db819981440bde7c6c3a50f7fe470e1d70f0350ec7c4bcd4808fcabe2ddfbdebfc7039ae2248c1455e2245f53ce44ec0
-
C:\Users\Admin\AppData\Local\Temp\DA8DF076-7F64-4019-9F10-0360FDD0A8A3\lite_installer.exeFilesize
390KB
MD528b10eff9b78787aa18e424fd9319064
SHA10bd2bc3665e8988567607460ea6bfc51d45d4d5c
SHA256dbbbf54115fb97f777180f67ee341cf16803ed6e85bf9af60ea13d9b99be362d
SHA512a908a231c9db21767066ab13ec4a8ac451bc978f5d8bccf5032e5ecbcaa996c7e2afff0121036cc184a3c19a4caf542bb15dbe6ad6dae16c422f6ac6bc5a791a
-
C:\Users\Admin\AppData\Local\Temp\FC6DA976-D840-408E-BABE-DC5A757EFFF6\seederexe.exeFilesize
6.8MB
MD56df2e368846222aef04e596d9ea43aac
SHA157b59e1002d9d971fc504df0493d5ac54380027b
SHA256f4adf79355ff21c11faf8283d06e28013478834a64d9473d27194f4dbcfed359
SHA512a40636178285fa12b1b6f99802fdfd3b569c674b1864f5c6893ccb6a48c90232539704da8ea478457ead39c1f94c319467b41142c8aa26473a280c4fb329f662
-
C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.logFilesize
35KB
MD59fbaddebdb3938d856b1f261d61aaadb
SHA11058f900e55ec5dd52dfcd47c724ed6a47c86317
SHA25614433e776c5e581e3a41bcd81b3358ef2a95a58fc38e98bd1e5e1319d4e03cad
SHA5121ef9944226e90a492f6dd1c0e7f690a997d7da1fa1398feedb4a26b2b47b0e0e19d471333922d2218236fbed09dc94d846d79ffe55b85c894c74d27ff3044889
-
C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xmlFilesize
529B
MD5cf5e17c0ceec22009d293aef3dc9a9b7
SHA1790769d8270c5cc303137f07474935130e128538
SHA25625a0b3fb5c120c9e5e4f006247275f0de6b0b503e5640ca2d28905bfcf2e1f85
SHA512de6c5adde773a01d3e0c19e3fe7e2866489b9c77afe7ebcc4add300bb4de7dc6fa92ec5ee038d906ac8f5c02e7055c6ef6ff85c53331fa54c79aea63266e8c46
-
C:\Users\Admin\AppData\Local\Temp\omnija-20244728.zipFilesize
30.6MB
MD514d21841ffb2260262648bd94b2e4f43
SHA1333eb0648fc7202ab8dfba4463dee762726b5e92
SHA2560b5cbd3136a86796083c365a7d316fcae54de82cb6c82d26d3d988918077aa28
SHA512408436474727e2015dc874544327d257b5d0c31df40798bc2d7a570e2214ad79ff1d555430dad62a337203ebca166f0dcf2d4a562fc3f44dc520bd7582cc9134
-
C:\Users\Admin\AppData\Local\Temp\vendor00000.xmlFilesize
508B
MD54b8818485b88a9d0beedade64a244a8f
SHA1ed5ce885f305f107a9aa1cdfe91481fbd56ae3f2
SHA25661d8e20fe5e3bc7b651478cd3afe4504b440fe6d1b62b84e0a167e74673580a8
SHA512f3601d1e0a6675542ac5a4a98201e2b2588bb2c6c3391fc887766267033389c07716234b87525f6497f62d4ad5e49b4fcea674578b2dc521769d1e9dd31463ab
-
C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msiFilesize
8.5MB
MD5c33dca31dbe43d47fd166a4a5f18aaa8
SHA1810a7e146078ad882f0560bcac0bfecbf97fa55e
SHA256d573221217c7ce85dc834752f709fac4d652ac50d785a1b3bed7891ffde9f06a
SHA512102d17b1ce3076f62edf1ff386aaf4a174a249a6b255a8e86adbea2400512a251d7d653ebc8fdbea48efa88f290c53cc675f3733c027b1118e21de3bdceff38d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xvu9bdak.Admin\places.sqlite-2024472846.420105420.backupFilesize
68KB
MD5d57cd95de07d3b15eb5cf8baa80471af
SHA1322c0e13f2022ab255a8d2a50c5835779b6ccc3e
SHA256651efdc8961efbf6476e4cc4b3965a4da72690ebedda009fd800c6d936a67696
SHA5122e98256a9e76ae384f88b83075a321f60cb13ee6f7e8cb93f1919103b82ba79a67b5eec8a7d3043fe26b377fae58545e82323813897c0e67adfacaa885d6f68e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-2024472846.998220998.backupFilesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-2024472846.998220998.backupFilesize
313B
MD5af006f1bcc57b11c3478be8babc036a8
SHA1c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA256ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
SHA5123d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
-
C:\Users\Admin\AppData\Roaming\Yandex\uiFilesize
38B
MD539209a570d383d89a1617d399ccca576
SHA1dc3fcb553154d2fe239341b0a2b34a862a296f29
SHA256a1e1073f37635d4ce1d0f1fd6728dd280b56c66913e5779d959904b64e2d2daa
SHA51255dafa3a0245a71446729bc7fe878a3ce922b6737ec74a69d46944286b1327d1bb70b0b61c5f0177d1242e702a63464ba1daba6cd5b886e06bb67d51283b996e
-
C:\Windows\Installer\MSI24C9.tmpFilesize
172KB
MD5694a088ff8fa0e3155881bb6500868bc
SHA1096626661b9bcb3b3197b92e7e3c4e77ad4b2df4
SHA2566f3a5bbd29f669712d6c2c7e5174dea6807cb86fda293acbe360bde81d29a633
SHA512bd3a9cdf9ea591d462be8e00e9bc44c391897c40d598ada19f0377f3a6aea97aba03627d97d6362edbb81763fe3c7570d07bdfd5a004dd9e7af4531bc490bdeb
-
C:\Windows\Installer\MSI26DD.tmpFilesize
189KB
MD5c3a831564e7b54fb7b502b728e232542
SHA182a4f969b1f19dc6489e13d357ccad9fef4837ab
SHA25643097d66f86e3a1103d4cc7c410e46daba8d1a7a991ab6c222d41bd2620c19ca
SHA5124855ca4429974a0b111d42b86cb8f89188310aaaf9174b4cf462a968163c8b92e38d4a519c78133301b341be5cd02e34b55b55575e84f0d01c2cd11ae74cce05
-
C:\Windows\Installer\MSI2CF0.tmpFilesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290