Malware Analysis Report

2024-11-13 14:28

Sample ID 240603-mfztcabb9z
Target 2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot
SHA256 4ed1bd9470e986123ecadb2e316fd2201f008dc9735fa12b1c1dd5dcb89a6dbd
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4ed1bd9470e986123ecadb2e316fd2201f008dc9735fa12b1c1dd5dcb89a6dbd

Threat Level: Shows suspicious behavior

The file 2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 10:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 10:25

Reported

2024-06-03 10:27

Platform

win7-20240221-en

Max time kernel

101s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f54eb5f578a61a12.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\system32\SearchProtocolHost.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{1FD4E3A4-6FE0-492C-90E9-7EE360CDB9FF}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A0EC6BFE-71F5-447A-A38F-F3622EE830BA}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A0EC6BFE-71F5-447A-A38F-F3622EE830BA}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\System32\alg.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298 = "Personalize Handwriting Recognition" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10058 = "Purble Place" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10302 = "Compete with - and against - online opponents at the classic trick-taking, partnership card game of Spades. Score the most points to win." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10082 = "Games Explorer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\System\wab32res.dll,-4602 = "Contact file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-590 = "Transfers files and settings from one computer to another" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\syncCenter.dll,-3001 = "Sync files between your computer and network folders" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10309 = "Solitaire is the classic, single-player card game. The aim is to collect all the cards in runs of alternating red and black suit colors, from ace through king." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10307 = "Purble Place is an educational and entertaining game that comprises three distinct games that help teach colors, shapes and pattern recognition." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10054 = "Chess Titans" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\sdcpl.dll,-100 = "Backup and restore your files and system. Monitor latest backup status and configuration." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\SoundRecorder.exe,-32790 = "Record sound and save it on your computer." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10056 = "Hearts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\ehome\ehres.dll,-116 = "Opens your home entertainment option for digital and on-demand media, including TV, movies, music and pictures." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rstrui.exe,-102 = "Restore system to a chosen restore point." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008 = "Windows Mobility Center" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003085ca5ca0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010f3045ca0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10304 = "Move all the cards to the home cells using the free cells as placeholders. Stack the cards by suit and rank from lowest (ace) to highest (king)." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10303 = "Enjoy the classic strategy game of Chess. Play against the computer, or compete against a friend. The winner is the first to capture the opponent’s king." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10305 = "Hearts is a trick-based card game in which the goal is to get rid of cards while avoiding points. The player with the lowest number of points wins." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\ehome\ehdrop.dll,-152 = "Microsoft Recorded TV Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\recdisc.exe,-2001 = "Creates a disc you can use to access system recovery options." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\msconfig.exe,-1601 = "Perform advanced troubleshooting and system configuration" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10209 = "More Games from Microsoft" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\DVD Maker\DVDMaker.exe,-63385 = "Burn pictures and video to DVD." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\sud.dll,-10 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%systemroot%\system32\windowspowershell\v1.0\powershell.exe",-111 = "Performs object-based (command-line) functions" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse" C:\Windows\system32\SearchProtocolHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2632 wrote to memory of 1620 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2632 wrote to memory of 1620 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2632 wrote to memory of 1620 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2632 wrote to memory of 2668 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2632 wrote to memory of 2668 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2632 wrote to memory of 2668 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2000 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2000 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2000 wrote to memory of 1448 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2000 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2000 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2000 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2388 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2416 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2416 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2416 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 2416 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 292 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 1b8 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 23c -NGENProcess 224 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f0 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 240 -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 264 -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 25c -NGENProcess 1f0 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 23c -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1e8 -NGENProcess 268 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 270 -NGENProcess 1f0 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 1f0 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 264 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 268 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 1f0 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 264 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 268 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 1f0 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 264 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 264 -NGENProcess 28c -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 29c -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a8 -NGENProcess 294 -Pipe 2a4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1d4 -NGENProcess 1f0 -Pipe 28c -Comment "NGen Worker Process"

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2940" "-buildid=1716584667" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write --disablehighdpi "--force-device-scale-factor=1" "--device-scale-factor=1" "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1716584667 --initial-client-data=0x224,0x228,0x22c,0x1f8,0x230,0x7feec87ee38,0x7feec87ee48,0x7feec87ee58

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1084 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1244 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1600 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1640 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --first-renderer-process --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1528 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2196 --field-trial-handle=1212,i,9404212217483185549,14435706536704771212,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2940" "-buildid=1716584667" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=1" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write --disablehighdpi "--force-device-scale-factor=1" "--device-scale-factor=1" "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1716584667 --initial-client-data=0x228,0x22c,0x230,0x1fc,0x234,0x7feeeb6ee38,0x7feeeb6ee48,0x7feeeb6ee58

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1148 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1480 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1236 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1264 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --first-renderer-process --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1480 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --force-device-scale-factor=1 --disablehighdpi --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1508 --field-trial-handle=1196,i,8207329705068364663,10487266065162901732,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 media.steampowered.com udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
BE 23.14.90.89:80 media.steampowered.com tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
BE 23.14.90.89:80 media.steampowered.com tcp
BE 23.14.90.89:80 media.steampowered.com tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 test.steampowered.com udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
BE 23.14.90.98:80 test.steampowered.com tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
US 8.8.8.8:53 ext2-par1.steamserver.net udp
GB 162.254.196.84:27031 ext4-lhr1.steamserver.net tcp
GB 162.254.196.84:27023 ext4-lhr1.steamserver.net tcp
GB 162.254.196.84:443 ext4-lhr1.steamserver.net tcp
FR 185.25.182.52:27032 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 ext1-ams1.steamserver.net udp
US 8.8.8.8:53 ext2-ams1.steamserver.net udp
US 8.8.8.8:53 ext1-par1.steamserver.net udp
FR 185.25.182.52:27020 ext2-par1.steamserver.net tcp
NL 155.133.248.38:27024 ext1-ams1.steamserver.net tcp
NL 155.133.248.39:27025 ext2-ams1.steamserver.net tcp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 ext1-iad1.steamserver.net udp
NL 155.133.248.39:443 ext2-ams1.steamserver.net tcp
US 162.254.192.74:27035 ext1-iad1.steamserver.net tcp
GB 162.254.196.84:27031 ext4-lhr1.steamserver.net tcp
US 8.8.8.8:53 test.steampowered.com udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
N/A 127.0.0.1:62311 tcp
N/A 127.0.0.1:62310 tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 34.193.97.35:80 fwiwk.biz tcp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 ext1-lhr1.steamserver.net udp
US 8.8.8.8:53 ext1-lhr1.steamserver.net udp
GB 162.254.196.67:27028 ext1-lhr1.steamserver.net tcp
GB 162.254.196.84:27029 ext4-lhr1.steamserver.net tcp
GB 162.254.196.67:443 ext1-lhr1.steamserver.net tcp
FR 185.25.182.52:27029 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
FR 185.25.182.52:27030 ext2-par1.steamserver.net tcp
FR 185.25.182.52:443 ext2-par1.steamserver.net tcp
NL 155.133.248.38:27028 ext1-ams1.steamserver.net tcp
NL 155.133.248.38:27038 ext1-ams1.steamserver.net tcp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 104.155.138.21:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ext3-iad1.steamserver.net udp
US 35.164.78.200:80 nqwjmb.biz tcp
NL 155.133.248.39:443 ext2-ams1.steamserver.net tcp
US 162.254.192.71:27037 ext3-iad1.steamserver.net tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
GB 162.254.196.67:27028 ext1-lhr1.steamserver.net tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 ext3-lhr1.steamserver.net udp
US 8.8.8.8:53 ext2-lhr1.steamserver.net udp
GB 162.254.196.68:27029 ext3-lhr1.steamserver.net tcp
GB 162.254.196.67:27034 ext1-lhr1.steamserver.net tcp
GB 162.254.196.83:443 ext2-lhr1.steamserver.net tcp
FR 185.25.182.20:27029 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 www.microsoft.com udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
FR 185.25.182.52:27021 ext2-par1.steamserver.net tcp
FR 185.25.182.52:443 ext2-par1.steamserver.net tcp
NL 155.133.248.38:27030 ext1-ams1.steamserver.net tcp
NL 155.133.248.39:27032 ext2-ams1.steamserver.net tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 ext2-iad1.steamserver.net udp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
NL 155.133.248.39:443 ext2-ams1.steamserver.net tcp
US 162.254.192.75:27025 ext2-iad1.steamserver.net tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
GB 162.254.196.68:27029 ext3-lhr1.steamserver.net tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 test.steampowered.com udp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 44.200.43.61:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 3.237.86.197:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 54.80.154.23:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.80.154.23:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 3.237.86.197:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 3.237.86.197:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 54.80.154.23:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 54.157.24.8:80 htwqzczce.biz tcp
US 54.157.24.8:80 htwqzczce.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 44.213.104.86:80 cikivjto.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
US 34.218.204.173:80 qncdaagct.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 54.80.154.23:80 cjvgcl.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 3.237.86.197:80 neazudmrq.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 54.80.154.23:80 pgfsvwx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
US 34.218.204.173:80 aatcwo.biz tcp
US 8.8.4.4:443 dns.google udp
US 8.8.4.4:443 dns.google tcp
GB 142.250.187.195:443 tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 44.213.104.86:80 ereplfx.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
US 34.218.204.173:80 znwbniskf.biz tcp
US 8.8.8.8:53 cpclnad.biz udp
US 3.237.86.197:80 cpclnad.biz tcp
US 8.8.8.8:53 mjheo.biz udp
US 3.237.86.197:80 mjheo.biz tcp
US 8.8.8.8:53 wluwplyh.biz udp
SG 18.141.10.107:80 wluwplyh.biz tcp
US 8.8.8.8:53 zgapiej.biz udp
US 18.208.156.248:80 zgapiej.biz tcp
US 8.8.8.8:53 jifai.biz udp
US 44.221.84.105:80 jifai.biz tcp
US 8.8.8.8:53 xnxvnn.biz udp
SG 13.251.16.150:80 xnxvnn.biz tcp
US 8.8.8.8:53 ihcnogskt.biz udp
US 35.164.78.200:80 ihcnogskt.biz tcp
US 8.8.8.8:53 kkqypycm.biz udp
SG 18.141.10.107:80 kkqypycm.biz tcp
US 8.8.8.8:53 uevrpr.biz udp
US 44.213.104.86:80 uevrpr.biz tcp
US 8.8.8.8:53 fgajqjyhr.biz udp
US 34.211.97.45:80 fgajqjyhr.biz tcp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
US 8.8.8.8:53 hagujcj.biz udp
US 18.208.156.248:80 hagujcj.biz tcp
US 8.8.8.8:53 sctmku.biz udp
US 35.164.78.200:80 sctmku.biz tcp
GB 162.254.196.84:27024 ext4-lhr1.steamserver.net tcp
GB 162.254.196.67:27037 ext1-lhr1.steamserver.net tcp
GB 162.254.196.83:443 ext2-lhr1.steamserver.net tcp
FR 185.25.182.20:27032 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 cwyfknmwh.biz udp
US 8.8.8.8:53 qcrsp.biz udp
US 34.211.97.45:80 qcrsp.biz tcp
FR 185.25.182.20:27034 ext1-par1.steamserver.net tcp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
NL 155.133.248.39:27038 ext2-ams1.steamserver.net tcp
NL 155.133.248.39:27031 ext2-ams1.steamserver.net tcp
US 8.8.8.8:53 sewlqwcd.biz udp
US 3.237.86.197:80 sewlqwcd.biz tcp

Files

memory/2340-0-0x0000000000A60000-0x0000000000AC7000-memory.dmp

memory/2340-5-0x0000000000A60000-0x0000000000AC7000-memory.dmp

memory/2340-7-0x0000000000400000-0x0000000000904000-memory.dmp

\Windows\System32\alg.exe

MD5 4338cbfdf63d814451856a987d84322c
SHA1 2c6dde7f2529aa8c4c4a597af7fb5f309f45da2f
SHA256 5838b458885ef9e6b8805f3fdaf44a887fe28dbe5cb53722520dc97647c5ebaf
SHA512 22ae6a960d465cea9d79e59e2f3b1b805d4a64ed62690471f60e1a0e1556e91921649afa2ed0d9c626c9cecb7aafe0a78cc90e0e97bd71cad860d738d591a0d6

memory/2540-12-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2540-19-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/2540-13-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/2540-20-0x00000000007D0000-0x0000000000830000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 cffb7797476a76983bd3bf34589b3a36
SHA1 1258abe79766433b6d96c62c2fa6e756563ed7b3
SHA256 023265871051063640796afa3a51a33070a15d8c788eeb23ac039c680f92a987
SHA512 97dd2b2fbd989ba66bc99d2ffc41a23af5f7080753bb78a6e7e4b73ccd407eb2a6aba858314ceb2c75ade4a22c01174fb28cd8cd300a5a3a34ff760b7a17c577

memory/2424-26-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2424-27-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/2424-35-0x00000000008C0000-0x0000000000920000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 75ebd58ccff537b1762cb4fa4b00bf8d
SHA1 ba7c3bcaf3908f38f7b541abbae823597754d823
SHA256 3c0e33e20b15742c6f042cba55ce6e2eddad31d1f873781727b528dd3bda83f1
SHA512 ebdb7c96374970e0bc62546de465e34a322ab726e276014bfd321696eda210c2dbb5ae810ec8a85c4cf5377445b8776a959d1a0c8e28fc208dab8d62a0a77144

memory/2404-38-0x0000000010000000-0x000000001009F000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 27b519c0e6cc0746642e2ccc8768127a
SHA1 1db51fe0fe788f559f8c11107c8ca5e6dbc7fc48
SHA256 e8c10b65d36344c09a675056dc9a29012dc0e576ff159ac8c310e0a5887fe5f2
SHA512 d9842845731c5f67d4a3788de627a2da45ed5867155a53f3f9a8577e64b9d89d61340116790a306644bfe6000ef8e0a2c160a0ce128509f7912adee0824849d1

memory/2804-45-0x0000000010000000-0x00000000100A7000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 2ba281fdcb3e3e92f456086956dd30b1
SHA1 46ef2a3358a2dde61d3803e395148368342ff362
SHA256 257a1ecf4c446b529eb598e839acfe6e2e7a455cf994c4ef8dc9c9f2c5803af0
SHA512 492a7d9a3825015fb93540fe7f7056b03c44258c551a47ce1891fbdc219937c4bb7fa518796c58db61e54519e1c51d882bd07866de86f970e2ed8ef2c432975f

memory/292-53-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/292-54-0x0000000000230000-0x0000000000297000-memory.dmp

memory/292-60-0x0000000000230000-0x0000000000297000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 4a501ba1cc7b1d70560b8f810abae810
SHA1 e7fcb6949b0b31aeccde0dd37c9136987b4f3c83
SHA256 81ed65a994b229715d42a6202987201999e587a7ce7b9f6029deaff00a01e6c5
SHA512 1184d802fdb98bcdbc731ddcbc6a7ce0f99bb0c3109f24cf03e5901322c383aab4124ffd09340c9357d69554059c61b0c124ecb15bb1e41d6b4650f66eba1b90

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 2236b2e8e7e9cf8191caa16e0d6e2465
SHA1 bea596ee00edfca4664578192ba3b2308ef1dc2b
SHA256 13e055975b3b4ac32a2f05e86eb9bc4b458184206088583c46ced957a06a50ee
SHA512 b1e91105a66a3872bd0abd4df74e6c02271215cae22d88703b82c5658fd9b9f45e4a37e11a57d83f0b5228adcaeb18251a73e2bffcf7878166b230b10ed804c4

memory/2000-69-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2000-76-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2340-77-0x0000000000400000-0x0000000000904000-memory.dmp

memory/2000-78-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2404-79-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 acf366189cdabdd050816b2ff38525b9
SHA1 f95644d355f8c0a790f401ff4665b0592a21d0c9
SHA256 6c81c71246795451046a52e5468b02bf4f6457a21621055e68b054e0045668b0
SHA512 a6757368128388ff77430e7c5a43cced6b0ed9c767e408b9db7db9994acfa96f1ee2d04c715e02710e6b2acab4a96b1ddab448c3db15a06918744bda2dc743c7

\Windows\ehome\ehrecvr.exe

MD5 2db802f69e63ac7dee40a561ba81c3b3
SHA1 3979ddb991bde3bef2be4938ce78f4cc2c0e7586
SHA256 616507d872ef4800130799e1169e537056fd32c47a2423c894de73b692f45177
SHA512 da927f83c0366869d8f65bb19927371e8919b75d17bb7d04b764173ab8d6c28329799234412596822641207a737ffc95120cd44e860499dc2fc0ff4c3890981a

memory/2140-96-0x0000000000A70000-0x0000000000AD0000-memory.dmp

memory/2140-90-0x0000000000A70000-0x0000000000AD0000-memory.dmp

memory/2140-89-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2804-99-0x0000000010000000-0x00000000100A7000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 9018ff24d313fe8b9bd07b3511a65dc0
SHA1 811eb13e08a7c8c36b648710b398d350dcb71481
SHA256 7c4083b50b9910b1e17d0af462354e180c47f7a29ce914887140e2b63e423abd
SHA512 9ed425a8b250ea51d6658c716fd11680c769ee140cca860f4af87a7098408d3480b48e3478a88b7e0317f4896719ed6dd334ec89ca11026869a420990d753a75

memory/2140-112-0x0000000001990000-0x00000000019A0000-memory.dmp

memory/2140-111-0x0000000001980000-0x0000000001990000-memory.dmp

memory/1500-102-0x00000000002A0000-0x0000000000300000-memory.dmp

memory/1500-110-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1500-108-0x00000000002A0000-0x0000000000300000-memory.dmp

memory/2260-116-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/2260-122-0x00000000002F0000-0x0000000000350000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 44b45e34403bef663f95b94c55d411ab
SHA1 3b71ecd25f16408ede7716c04d2cebaaaa7c2b56
SHA256 1f4fc660425a8861c8e60cc80db8cc9aedf4219da3e4160fbe1ae36dc491e647
SHA512 1f2192de50a29241d6ef6d7b5ba816a2408f8e094e0073bd6bec09d3195c99565fe6bb4697b3a0484f5c7e69e7ba8c38242bce80f6f180d4e1ffcc2590e0f027

memory/2540-124-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2260-125-0x0000000140000000-0x0000000140237000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 e7e56eff53a663d2d0496ae547e8b51d
SHA1 7ead13620cb6b0c255fee9933744151e3c9bd3f2
SHA256 d1dc025ca1494333097bb3b02aaf99b31907eb2fb4491150a3de658c13497ada
SHA512 aa21b73c5e751c69a4409274053a603be432dc77d334aba8b7fe0b5c87bd1af4db8e252d555f715adca4c174662869115c5fff22eb60b8c98ffd52eb64be7ab7

memory/1328-135-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 97a2fdfeaf091652d04c2fc75efb063d
SHA1 dc3c4adb9b6893058c8da9f113bb9dab34fa58c5
SHA256 51ffdda57c11bd4a695b9a19cdf6ae0643caa7989e730ae75eb51ffdcf7b993e
SHA512 7dd88e7bdaf41fdb4d7be1c4e8823f09cd6cd7bc492f8d5fef427d5f038c776113c74d45ef71817670dc2d9961fc722243ac078919919503b65eba96c4e2f34c

memory/2424-140-0x0000000140000000-0x000000014009D000-memory.dmp

memory/1124-149-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b3eff4687b862e61feb62bcf49c3bcfb
SHA1 904ab4228cdb070287df2ee9399814e69953058a
SHA256 1ffe646df27751dd24e0a61e072afd7e2abf79bfa07b849797e2cdace468d893
SHA512 658d3862444bc6142717225c3966c68365fe7125005f538907974e62d051b235abb95eef73abfc25f3994378b364b3d22960562b8233376d0dd728dc09534104

memory/1240-152-0x0000000140000000-0x00000001400CA000-memory.dmp

\Windows\System32\msdtc.exe

MD5 e16bc0d06e4d21c2614602675cac13c6
SHA1 ed5a290c49fdc748e4797f4a1cade68671d10862
SHA256 900e21ae39813333c979065d7779730d3106fef85be7e9c9d37fb2c7de4e430c
SHA512 0bd3975108f47a80a72232ae41334ec479007cc32381fae692b09f02bb3de070e825f81559c3e22bf13baf49cd91535b906fee6fb54349a94e9cb6fc502ee211

memory/1012-165-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/1240-176-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 d64a921a2f5c7b1b60243bb001539b93
SHA1 089c6e0c16172f018d4cfa6161efa7e8c781c884
SHA256 1c24eec1748199bce0d0cb0a15cf0434f746ba5e1f8bc39b76eda1699439f069
SHA512 9ddd67115feee527c4d09fd2f98e51f1a19873302406d9c05730a136741f8ac7be308165bb26cd44b32efd7f03dc58f9c96c7401bc1eec9989c129d17b5aba6f

memory/2776-181-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/292-189-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2776-192-0x0000000000430000-0x00000000004E2000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 abc60bd5d4aad97f4aac3dac481c4918
SHA1 908e7d96d1917dea3678c9c188d2fbde49ae1e5f
SHA256 c74476e49a873882b8eab8142977594fa7fdf395ceb1369b0a104b5fe2eb917f
SHA512 ba432947e4dc4c0cf39c19b6bdc286e737ef8625f387c85441e3e11935aef7c08c5d55597278b3e47d97e1c93ef415cf15db64dfa0d6a1d37279738d31685710

memory/2192-202-0x000000002E000000-0x000000002E0B5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 4d2f43018c0556229ab45489d2ba5098
SHA1 ba9430cb603df137025aae3ffdf2a857b3c7df2c
SHA256 e3ad9c83b79e60f7194ca329e9716c2a607bc7dd185456ea27f97ff7e20cd0eb
SHA512 7a404afa9db2dd9ec98d7d417dbb8624ee49f16a3ac7a166ff4f1a7a92c5bfb68e89a18c831f6b563a256f31202ba4d925b804dfc69450e074317f8efb19d41e

memory/2140-210-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2544-219-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 baa09ee0ec770b5c59bf7198de9d2e60
SHA1 5c35982f3a0e64da0be5568f18b815364bb5cc08
SHA256 7aac561f7f950c302dc3d7e31abe3b9b13c2c3c23f8428a30b7738f56fe867bd
SHA512 bc61af862f242adde5200c34858649fe983cabd1b25d358fea9398b78fde4f81da45533161f64f36d634fedbac019a647fd5ee26863d8fb569aab893bfcd9cfc

memory/1500-222-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2892-224-0x0000000001000000-0x0000000001096000-memory.dmp

\Windows\System32\Locator.exe

MD5 bc833ced35560215341440d3e188bcda
SHA1 f0ea64a5ec1447b8277e45ea9ff1ca39130bd3f9
SHA256 946f75269863f6aaae90d337283672d180dc81b820ae57e9fba2b4831046406f
SHA512 fb3108012e34d007d9617914472d5839c0ae877634767c63a47061d616db3512b76231bb4ae45e3a8ddc20be72ceaea8dbbcb1af4f8dd1dd53b13bcf73a12c4c

memory/2260-227-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2136-236-0x0000000100000000-0x0000000100095000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 afc26041a3be07d53d83563dc27233eb
SHA1 f485c95724fc5751b80fe90de9a2943ec4bde64e
SHA256 bcd05c90f69c6b270a5a58d476f9fda715b553d3518a03255999a2b19ff36398
SHA512 d41227b7a99dfa91491e0b71fc7cc68f67d712475285999ae2d0cfe4780c78b85fbb2cfc35e2ff8bdcb4ef174b998d71d772e3561b9d14bc6f8a16d6168de8ef

memory/1756-249-0x0000000100000000-0x0000000100096000-memory.dmp

memory/1328-247-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Windows\System32\vds.exe

MD5 d62ade3c815a04b370cfbad741942202
SHA1 9d19a1d0d74402d86706e9d1ebba07d8017e2556
SHA256 d47674a41e330c39ca501e9929e276b8de2d7bfabc89b76a59816feadf515168
SHA512 d9c39afbbc0f0112ba5160e2b72402e5d45ad0f44990176bfca89410e9ab8924ff3200360b7430402bd073e90e36783d5e2c9e1beedcdfc45394deb55227802a

C:\Windows\System32\VSSVC.exe

MD5 ea26765a6e3254b53fddbea9db383147
SHA1 c4863a40b9b75c2fdab0d41f90df475d1ab6d867
SHA256 02078945c824acc8e0a3f720907b7c6ad8205ab75a9ac1905f7c61986496986d
SHA512 a309a14cd3e7348c7a3ed234de2699c4a784b4303b30d6282dc0dfe6fc94497dd58ed92d36c0ccf836d310ed31611533b958fb6d905f60568040c6b72460b7fd

memory/1124-262-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2828-271-0x0000000100000000-0x0000000100114000-memory.dmp

memory/2316-273-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 15a468968bb1c157b5742f631de7e22c
SHA1 4efecc7e6519c7ccfc3ac38448552bf450ff179d
SHA256 d4b79ddef19536a046c1ec78e2915e342926294aefd9eeb7a8199b50fb2d0413
SHA512 e7ffafda1b0aeb20e127f9e99b4b30e6d4cc578af104959a290d1b532d9178aeabe1c094b1adc28d0ff4a1d3da0da39a62e82a5e039404a80510fd61ec3db87f

memory/592-283-0x0000000100000000-0x0000000100202000-memory.dmp

memory/1012-276-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/2776-289-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/848-290-0x0000000100000000-0x00000001000C4000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 0485ea5892243651594ff6b225f47927
SHA1 9df9927c3a5c1620eeec6d9259f936838d0e3d54
SHA256 a32a04a7327e9d837b24888cf7b9f19cf60ae8f310410967920b4c4b5a92fade
SHA512 ecfdce29dea46b04f75f75f24a05843681528405447a7eaa38e08e9588b4333e9a1eaccaf6e1c99eac32ac65b1df0caa1505bcafb6480f044459a68183db21cb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 731b72233bd9e93921091f7759d41e69
SHA1 fc089f2a0eff9d48f17b6485cfa455af27c5778f
SHA256 60a3b73c6c893b611af9ca0a51c52b8a91cd603af97e9d945831fdd313c17b75
SHA512 f536546f3fa3c6eccb40b4edd13a6180c958c1221759a1a067369c3a7100f723d33a8a2c746944a6a22658ad676a29e1e54778ed98817169282bd93e789b14ca

memory/2776-318-0x0000000000430000-0x00000000004E2000-memory.dmp

memory/1596-321-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2632-324-0x0000000100000000-0x0000000100123000-memory.dmp

memory/2192-323-0x000000002E000000-0x000000002E0B5000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 68611301170eccb498b3cae9fcae4c7e
SHA1 81aaae43a5dc12d189cf3ea256dcef00a7a4b6d6
SHA256 1c4ecf7e7f3147183089811edc94ef0908f315c3627632f2e103e51af01f186a
SHA512 4d5d2fcedf9136bb2a5324f603cc0c12c0134b18be9c4058e98fe30e52e77db20d308d4981a113826c72748894fd2622b49f9f5659aea9c3834437e9507274eb

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 395b90b5d6e98603b7ffaddbc8383fb3
SHA1 0a6cbbddf032fbc48d9563957c84d12b3d5c2067
SHA256 b378a93abe22dd1b2c4f2bd3025f2141e4bf6b75519956d7f50815f372eb8dfd
SHA512 4ac46bb9d50f3fb2486b547ed590624d21ae72f4eccc65b92413cd0944585d2bb69af48832729d3640ca6054f31e45654ddd93b8d26eb449393298eb37834821

memory/2544-498-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1448-499-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2892-505-0x0000000001000000-0x0000000001096000-memory.dmp

memory/2936-507-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1448-519-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2936-542-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1304-571-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2136-562-0x0000000100000000-0x0000000100095000-memory.dmp

memory/1756-597-0x0000000100000000-0x0000000100096000-memory.dmp

memory/1304-610-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2388-619-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2460-622-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2316-637-0x0000000100000000-0x0000000100219000-memory.dmp

memory/1644-638-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2388-639-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/768-650-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1644-652-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/592-648-0x0000000100000000-0x0000000100202000-memory.dmp

memory/848-662-0x0000000100000000-0x00000001000C4000-memory.dmp

memory/768-661-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1596-675-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2432-679-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2956-683-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2632-684-0x0000000100000000-0x0000000100123000-memory.dmp

memory/1164-695-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1240-704-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2388-707-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1240-717-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1148-731-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2416-730-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2416-742-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1224-743-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1224-754-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1532-765-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2044-766-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2044-779-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1572-778-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2044-774-0x0000000003C90000-0x0000000003D4A000-memory.dmp

memory/1572-796-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/884-808-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2936-818-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2672-828-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2636-845-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1320-848-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/780-859-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2196-869-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1500-880-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1328-905-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

memory/2140-10619-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2340-13032-0x0000000000400000-0x0000000000904000-memory.dmp

memory/2940-13034-0x0000000000400000-0x0000000000904000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\CURRENT~RFf77228e.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\000004.dbtmp

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5672.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 33c8a0232288fab31006e6b171cea336
SHA1 12fab1e356f50ca9e2a3456d6c4e7c0febaeecd4
SHA256 2aaf9664ce7c23bd9610622ee9d53bf5ef24de847080f88e0da2cc2bf6d708db
SHA512 8f1433e6bcd67b1f0378ea60f049b768f84b4441313ac3e716c628eea6f077185df6a3d1fed006615c58af747a286ef825e6e0713571f2819c48bf8325ea65c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb859cbdff6c369b1ce507bc061fbd33
SHA1 2e9d338086fc89b7b833e8aaf52cb0dbcebb45ae
SHA256 0c6b61677f38cae65a304624835d5478c619db29b585163f3c3c037fdb9c2b39
SHA512 cb042766a6589d7404b9f53000b7d9fdfa58406b05e2e4d2ce641b8ccb41c01c3a19603ed836cc208638eeb312d8ba853d329b8c57c22ecd41b727040dae7e43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0abf694b69161832bc75d4f574b1a54f
SHA1 a3197e8918f9d36b9cf1bfc77318803deed3eef0
SHA256 5d47eafc4bcf4fc73d9664b2d962c1091a327389747726ba1193332794ae6946
SHA512 df32dace87562a9e07e8197d49a55420bc8a09efbe88928fe9fd8ea20a8ff5c353c2aa138a1bcdc288b76f08dfae73eea9a863b003b5eb924ad5aec625d75fb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a567dc000c594d698e991233524a902
SHA1 f715eb218995d997e62ccff2a055885ef0a1d7d9
SHA256 f08112b7a56c22e86c4db21ecba3c870908304d5cfd8a5ec3297ac7f209713dc
SHA512 f4a3553031c88fb0dd835e31ad3ff80c5875ac4065ffda5700ddf730fc888dc4af3d57f44f9dd9d2a96af9cd4ecbcf8c17b7f780b673d14d4efc9a75624cb783

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 193cd06e774817818a1d180b8c94d236
SHA1 d99c568c1e94974574f534eb56d4dd4f1a25db85
SHA256 75669488eeb223cf21263dde5f0ac201e5d60cc89399a827475d093523631f17
SHA512 6a6a1383ce2437f8e7a18471c7d6b20b4ba5be63cc73da147c66a2ab1c3ba896d909587e0ada83301831d0cb8731eb8086e8ae5465c659966a23d0c7438a790a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ce3607a186d908398ebd5fd030e5d59
SHA1 0ed6b41df6ab5d1cd899f90644d5473525cdcabf
SHA256 c392b69e387d6f8b03611cab24b533aa56e949c9bc94c8dda6dad2be9a3865ea
SHA512 0d95356ba068952130aaedcc14ff3a918959aabff197cbe1a86527a912df811f983496a0af3f8eda05c0ff38a3a44b32b8aae410dd4f9b450b738a17f3b930d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6a3a15dbab2bf24ee4dc5afb8fdf5b6
SHA1 d59731c6c0c51c962d1382d59dc45d195adee995
SHA256 66fd00805ea684fdba1c0055ab745e42108ba73412685b04b6f2bf39022c2bf5
SHA512 fc7ffb252f00c34dae47c790a04e3b55483b38b97a07c498d27db6f5487ef806ab375d51901bb9c1e87d9bbd28a7d0ca6cc21fd603c709e0a3e3f549be87df12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 396f07ef719ccd123231808533425ddb
SHA1 cf8c34fea0d6c701476047cbfa8f449e617b91f1
SHA256 83347b7ef2688c269eccd7515a0b4265f47b808fa8f8147875701a9c53c2fa0d
SHA512 292960f0673ff532f9a0cd8a615c26382b22f2c04abdc723957a10d1db1bd58d156d4f497039f7420feab96de958722fddd1d7fe4cc968f4f6072a524bfeb69e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a16b6e0c2ca577295dcabe7c41738bdd
SHA1 fbc3f1fa2bc968a40b52357720f9323041aedaf8
SHA256 e924cdf8476cc7724e2b005c3520dec6271e83d751c5124497000d823855ea19
SHA512 b9c0318355cfef0f1509a35f030ba54eb2c4e30842eb5c3569d12c41f4b553393752987ab4ef7dc0bd2ba6ea481aa6a9e54efa9e404a6ee072e84ec6fa3c5a9b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5cae9cb6838ca7739961c8438a451f2
SHA1 ad8308c93e9d42e4c9c9bf34b9a45613a20d0089
SHA256 b3fa5e3a70625c97e0a803ad3062da616eff66e5b9caa2e8e4eec29c5c835bae
SHA512 c29e4e7abb81e58fd40fa96ff3c5edc6ce90ad3cbc0f2a8393ff0820bb1fd6000c9e9ac09f7d4ee26fe19679e03a4394ff630046b6a781a9fbfdfe245e803ec3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecbbb5c3849f0c8db23f662d2abe8056
SHA1 65e87c7979a0f3d737767134c552d005506e2ef1
SHA256 7714040408273c31d3a6c2612a075dc3645e396e24339df74835d7bdbd3be03a
SHA512 7be210e1112dc904e10167bc137be38cb7194135a68c7f7bd027930661414fc664766d965f3b375a2fb23d19bbf865cd93e59b640f80b1183122f67a1fcee2f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85360d44636f016b655c38ce2bfd8a60
SHA1 637b6b3189fdeb98e32bf217e36420b25af890d0
SHA256 68ce632adf2cf0fe45b0d80af6e3aca3419edd9cb11191669051e01268c388bd
SHA512 539363c2178aba479eed9fb81ba1f72c6731f92a586e718ca702096b7b20baa2349d7ed27b25f667130b2552b5390ea0e4a87c5b75dbe78095639f9e0934a6d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 610313f5b1c1505ef440b8805ba27b96
SHA1 f99a2a1943f5cc21cd7135ee9833be570e783a9b
SHA256 8836ae3ca9eb1b27cdbfe5d952979afc5f311c178d250e19c5cfe403348dd60b
SHA512 5a14402a4954ebbd4406d3c176bb19566d1b92c4c7142f6e4cfdd93bf0e19d07052407ea27d2fa4585c1a598f343a2eaa50ad86afb8d4b0be8b74fa35e801589

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3b96e469e9b6776e906a00c6ea0fdb56
SHA1 112f176f6adb389a42cdf21efff2ab12de26e255
SHA256 2825f99c816a59f960e6988eb758e1ed09141826830ed34e815e87edd41ce6ad
SHA512 136b5e709a4a989d5abbad297c40cf118504d6edcfbd0ec7de8e1e81ca22bff5ceae41473b04c66ed454556ad7fac19298b346bff74b358a022509f0513c2595

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 58b48f8a9f97cd55af52e92bc204f3df
SHA1 004b1205b218699778a3be626983e9b3777242f7
SHA256 c372a4b557a299940baf25e1739e72bcaac13b4dc2fabf7ff5bcd5d18ed8f7cd
SHA512 f524c2b822287e1d4d70aafbe2ed7b8acc807c4c993beef383e65abf08af31fcd68b104f22a2cef94b1ffd0e2f9291687c79fde6a46b87a325cc51943baf33f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc5a4c0ceebb5675aa925a5a06cfbc6b
SHA1 0b8317e6d3c11de73b4e8994ea56cbee1c207e96
SHA256 1513977248092e2de6d18b99d2c70189e9ad0fac783ba449d877ef21197c360f
SHA512 d194c0f70a1d7c2a552269565bb5276b42221ff144d7a7b41d31e2cfc2cc81da8c25ad18089a169455c55fb85125fdaeb40612d8109b9091768f4831106d9a8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5faaf019454b600a3200de9daba5e26f
SHA1 59d73b17e3341412b773c0ea136cf9fd112e65c4
SHA256 d481bceef3f7245fb373dcc3355c011179f0c503a1acbac4acbe3d40d47972bc
SHA512 260b8222773a81c08686df66f494a14cd7531ecedc6a9a4b684a46760f6483698f780bb28fd0faed809f4f3a75e0e9dcd97409f9cc0f70483a469c86721931ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f8570d511b119153cffe6d17d4eeee8
SHA1 866a57dffcaf2719e5911896bcce813afcb154aa
SHA256 e5b5f2a55cc290be7e636fb94ee05f601366d06fe45dae9d2754057ed16e4462
SHA512 f56b6fe664bc8537884f32f68b1a01286c3314b1c687d554c731f029146b97e9e4c9309c8a47615472b2c509508d5a78697bc1f64c0b83703b52f5e1c33dfe98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9eca3598d7776caaaaf59b9222ee238e
SHA1 88161313ce79879e2ce482cc4d780a94ffcacf01
SHA256 226e14f0a7f43f06f310570a4c42d9324cf33702bf98dafdc84dd0ffe396d65f
SHA512 a5bc8ef7e1d8a3e56d64d8d9ed5b9e534ca95890078d0be4ab6f3d115bc347df0aa1a5436da783cf93b0d22c24ac652716dfdaba58cbb71b1167574ea7b46ed3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 378dd73201ff9d0c8e355c3b4ac832d7
SHA1 c27cabb94aba497243116b921ced3e6efeacc91b
SHA256 1062fca545938bc1323660fc592401d6d4e0e1aa8bacc6fbe2fbb63a11ccaed0
SHA512 0dd3865da956f76fd992901fd9e2a26859adb630048e496f8d3e043d9e65d8e4962fd24b802ceca01106d4b6139d714a488d6c6c13c6328cefaf74e4b4c6e33b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5d45b73d61e6c88331753f77a723182
SHA1 5dbebfac861ccd06d4fb1ca1f6251e16f0693580
SHA256 e185623d36cccb91514c0129a23c5974c31d7bba0e288bfdb501116a9cf9396f
SHA512 7da0d8aee5c6171734698fdb130843e028c1aea394c5004b0a47da009bb49148296af06ade6298563ff807ae6f2225d3e96a55b9ff3677ec945bb6ad3eac65b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 721c20b31eae6a9d410eb8634c970b30
SHA1 d9327e90520c4df4cc7c4b4978e4119bb8d7a506
SHA256 5f667c4c3ba95e0149aa3f956802700d384f2b2051de8d8d47386dae17428285
SHA512 3e37ebb3a79fc1e1e3f46591508c7cafa0ea3f7688573148a4b133c78c765e3df29907471c6cf64c899ab7610ca1df17d5b6a5bd088bf66029b9976c1d27cf36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c4c62908e81331e48426596617a48cc
SHA1 36c252b650efe6ce169c08bbe897fd6b1c9ca273
SHA256 d2105221fb92a3f3353b210df6f04bcbb62c5ebb1e18627df4be43a46041b3fb
SHA512 fbf4de1e9a9c745c9631ca1e3366d2fbc1adb287c63659b52fd6ce5bc268f0b6b5bfd283428b7cf44d2d3c06b0147b0f3893f8dcf553db29712d36c7c2e1293f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40f0b27d7fac0a80176692202242ccf5
SHA1 2ae71973e9079583d5c8403f0de08e7a7f2e6899
SHA256 4b2dbb0071bb78ae3acbd599135aabe18bf23c3536d2fbbac6f86fff70aa8f23
SHA512 f034e0cfa0681039bf2175b121cbae27d68e71b4fce5bb8c94df7980d7144118807fbb4178046d37c975a3604b71d03911526a9f5461ee836e8283edc58d443f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19b2b90283a7b6d3a03e2243210a4c9a
SHA1 c4954628f431b0ce6e7d6ab178ddf0d56a144812
SHA256 2210b91931b0d4d7a8d7d7a068e58e158cf09f7b08586af1c2d118e6a03e17d2
SHA512 43fbd6b50f9d2364880ef67dfe10a1514d1be5b0765d124b0d95cd3fd514bd7cb6711f5f09a643ac6fd0e67ed24133d14b0f3aa510befd4a9769176b0f9b5252

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 7cc934642928cd5310ab73ef4e7fe583
SHA1 eb1c01b9382e824747af4b66bf16fc4586aea445
SHA256 dcd25e6fe207f130aa262b46d946dbf41798fbaaad1174f4dfa1e6fb67d3594e
SHA512 f6a8216f39b6ab1ac41df7805f9c7959b79d6211eee019a8f37e7cfad5737e52776cf23fde4d1395ec9e5b097f452afd398be3ec62d60437787d16fd3f354c5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d93fec50c2de135d43f0c5e6515bb0b
SHA1 8ab343fa3f5fd36a084ce7f290388dee8bb0d76b
SHA256 c0217d9266fcfc5c2250e6980a8cf93a177ca68a43b2dc9886f83eb0f422718c
SHA512 e878eecf48b2fe1228ccc5c100c1ee358620cc1c8b8ea48d9a48ce0bbe0f5133a399507c01c4b6d70c99a238c48022c813f1aebd752beeb0b8ac159632c77031

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8710e7d6b39794faf0cd43b58d291658
SHA1 e9b58985bc6d5907e8ca09ea10d604bb5ee3b669
SHA256 1930001f87e43760a46caa1907237208167377ced338ac0889ac70cf9e5cea50
SHA512 c069a64db6b049f9d63c4064c7411261023947818135979ccab8a09916e5d40bb8f0c6423c85dd2358a8318c48c020c54c753cb9b75ee61acd1fe7b94a44cedc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40d0b96e4e95a7187f1803ec8e656d87
SHA1 5840952061c5c6bd83d73327d0c4602fa274420f
SHA256 cb91551c5aada58d19cd1e24685e768ace0cc99ad1e498be8a70c9fcfdf7e552
SHA512 a8612792440c937e8e2dceaa3026c25481620dbfdc988442a91f5cca0e5099beb9dc25c491e725d1d82315415c15c3fa9113d73a9bf69402c4be3ad2d019a69a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 656993e3d0164948808b479bc177f483
SHA1 8bc81d62a6d7bfa5ff5f10b951f3981edf676a91
SHA256 a8ed7df70b5cfdeb1ef0271354a94b16d656894075076c107e32242be7de69f9
SHA512 7d2b2d6a266ecf1f7b1de62e43743ccbb686af40eb8a8c0ecc5a5642b2268bca541e44aaf400db167a69a5a1b6b89e65ae8202e4b2442d6bb25f6d7f05fd3650

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a00630c02a0f89e9acc1c5d8f4c1d3c
SHA1 e7974cc673a9c9aed3aec5e23d18ea920c42d445
SHA256 cf85ada73a034295d21ec1a6283ecdee9ecb0e9d66c81cd15fd8a0ce2da4d6c9
SHA512 fef509d8e603361e16e8779079c360805abd0248840a0654d2152aa04d5aa500b7d0036fba108ced1458ee37882a82b74429b3d08af13098e29aefa8c847eb6c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6a988d2e29aeaf53d2b8011b360016a
SHA1 8704450195ff4033cd74132bbd571aa1a1ae87be
SHA256 90c928776a895ccf42b71832f2e2c0c71e2ba7d035d7b4d640886e1061321dc6
SHA512 d3509fe9feabea1dac2b74499d15113df797d3098453e5c499fa071eb2b5a8c4d4c1a6979aebad0c29c4ed1ec2b25d4a974aa30dfa5739ada14cc3127b398051

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da08cc94d71e20cab51f0ae2126696a8
SHA1 87a056309dc2f0599b96d301f86a9844f2759a53
SHA256 668b7d9a2a20d5d678d48ddd73bf3298917278d03ac87c240090623555b1a556
SHA512 04416c151e5cd2fcac626e512d0289c8e8bfcd35558c3a747a9c5e213722496a3fbe0e7d189d7453e16b7b6f6b0c039c970d6b072a09b2dbf13d2d3f04cf7e5d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51256378d7e7a20053f8aa47d860f258
SHA1 bac7d3e5abc32c2b8440074a7201a1cda39ab84f
SHA256 492db79ecb7786552c947f374bf5345fe9f760ee4f640232f7db2aba89777ff3
SHA512 e1706c6ac395be64a085ef6186e84b1e1afc04b0f6a8446e8324d1b7cb912a8e9f0a9bc7fca80c113a0eda81c83a2afc517b1f0242467ec645428078b339235d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b60c7d5255008a7edc600f4a1f30c843
SHA1 61a570bf94472fe2a23445d8d936313f737902bb
SHA256 9eb31bc9b6499d9d72024eb663a0bf2f559846287ffe40d235feb7c9b5351d6d
SHA512 a450a485050c9b542fb88c1f4de184f35fb5b29eaecf4154b8fd168ff3b34484b73823e643d610567bac21fcf74b0b1004040aee55cccac68e031c9453931e3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0597210563b2d9ce40b6ac7eab3133d6
SHA1 d069cd305bd64cfb3a6d3a497a2c7d2ce0bcdd55
SHA256 ab40fd0acfcdbe98541fc721ba4b14d3dbc39ee15da2132bdc8ba34e500487d8
SHA512 632bb9e978366d4c698d3411013aa19a3dc772520754140d437c02b259826023b8be36f772695cd526a13fcc76089ea403c23e39d377bfdc9433b506fb6698d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 556cf9e7c409cf004383b42e3a5b2e88
SHA1 b16d7d564097803933c08363ec0aa9f383b0a629
SHA256 9f86ae890e39c5a30f41251ac2b9ec7bed361d0600b162f460d6c4ef68e48d2b
SHA512 2c0d9b9e16a010d87ee1136e31ad90f919a1ce53a2ecb0a2cd2bfc06399ede50c3a24de454854e4e547ae8ac0448a2b5fe346d656aa61f52c58e87b348d2d1c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de006e7d496c0fb61e44b5573f736dd3
SHA1 a7e5c150c03b92c3c65363b835446cc9b698bef4
SHA256 0c5807f08463bd66590e4d717e6e8ec2bebb58ff2761dafb1c8cefbd905c4414
SHA512 12d60183e95b645c1e32ee02fb30c9eae45fe665fd29b0f8bf1f8aba4b61f2faef5b0c093f28c49d1afe470d9bfd3767fc86a8a2836abd0cc10faccf903e485d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5eb0d3a407a3e308ecc81cf1d8976d6
SHA1 0eec90db493c5bb96582e0305b2e85e50cddb076
SHA256 473e7440a12c81e9bddbeebcafb3ecf126bef409d468a8b1c7500dc670cc8ebc
SHA512 815383a788846a74e4b60849eee4bce0cdf9ab46360fe867df7b646ca4a3c2871b25ae1a1ff3cdeecc6876cb33653abb9744a29935b26d33725137adf28ddc4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 812065220da1caa60f9acc09ec4e9610
SHA1 db2285cbd83e2fd95f15d685cd8d82a417b16307
SHA256 397c422f59bd26c5bad2b49518a775537442c53c244d8fb5a6bcfa52c013d0b4
SHA512 bb4e32456ef03b41c3a095a6979e0beadbfb6e55aac619cb5bf0550c33efe4db9e0c4e4167f51765b39b5c99ced3034cb09efc3babe235f48a40a70e8a9937a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 101ff78d1458b1f69883fb0b75dc342a
SHA1 9d644367d2afb8d0addf173503b5ace10614a072
SHA256 2f58cfbdc2f9e80ac4b3a5a885ae16e24950cc13d594fd0ec62948e9d4b52fb3
SHA512 8dc44c97f25c945d4c098eee93374e854ff5b0f6abc917117065f9d92fb24b2f0e8f1797af8d9ac567d64c735bdb48453f4846df8d676b17fff206e527724fbf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8302212a1a680f6aeb731f72510cf0d0
SHA1 01baad6bd18a7eeb691b4a7037b034d55dfbef41
SHA256 c75deb50f51f6362cf6d67713b8243aa4186ecb5426c580f2fae0e35e475b6fb
SHA512 7adf505293c11700dc0e99b7116864bc043302ce6da9cf377496beb8b4e0120a443e3306784258b42e49aa5fb0e7cd54f96d4adb2fa29aeaef2ae3369dc1ed8c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 10:25

Reported

2024-06-03 10:27

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\fxssvc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\SensorDataService.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\system32\spectrum.exe N/A
N/A N/A C:\Windows\System32\OpenSSH\ssh-agent.exe N/A
N/A N/A C:\Windows\system32\TieringEngineService.exe N/A
N/A N/A C:\Windows\system32\AgentService.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\521dbdb1c3136770.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccfa2f59a0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000aabab5ca0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ed3ce5aa0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4f1e959a0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccf84e59a0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ce7875ca0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4f1e959a0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043a4fa59a0b5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 4656 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1260 wrote to memory of 4656 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1260 wrote to memory of 1632 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1260 wrote to memory of 1632 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3688 wrote to memory of 14244 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe
PID 3688 wrote to memory of 14244 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe
PID 3688 wrote to memory of 14244 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe
PID 14244 wrote to memory of 6832 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 14244 wrote to memory of 6832 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 6976 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 6976 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7224 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 8068 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 8068 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 14244 wrote to memory of 7824 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 14244 wrote to memory of 7824 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
PID 6832 wrote to memory of 7736 N/A C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=14244" "-buildid=1716584667" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2024-06-03_06bb37eb2744eb9f23cb1a25b82c5845_magniber_qakbot.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1716584667 --initial-client-data=0x3ac,0x3b0,0x3b4,0x39c,0x3b8,0x7ffe8a46ee38,0x7ffe8a46ee48,0x7ffe8a46ee58

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1704 --field-trial-handle=1760,i,15448163332235978232,13809633619316081230,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2216 --field-trial-handle=1760,i,15448163332235978232,13809633619316081230,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3c8 0x448

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2528 --field-trial-handle=1760,i,15448163332235978232,13809633619316081230,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --first-renderer-process --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1760,i,15448163332235978232,13809633619316081230,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1

C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 media.steampowered.com udp
BE 23.14.90.89:80 media.steampowered.com tcp
BE 23.14.90.89:80 media.steampowered.com tcp
BE 23.14.90.89:80 media.steampowered.com tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 89.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 44.208.124.139:80 przvgke.biz tcp
US 8.8.8.8:53 139.124.208.44.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 44.208.124.139:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 test.steampowered.com udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
BE 23.14.90.98:80 test.steampowered.com tcp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 98.90.14.23.in-addr.arpa udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
BE 104.68.92.92:443 api.steampowered.com tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
N/A 127.0.0.1:58309 tcp
N/A 127.0.0.1:58294 tcp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 ext3-lhr1.steamserver.net udp
GB 162.254.196.68:27033 ext3-lhr1.steamserver.net tcp
GB 162.254.196.68:27023 ext3-lhr1.steamserver.net tcp
US 8.8.8.8:53 ext4-lhr1.steamserver.net udp
GB 162.254.196.84:443 ext4-lhr1.steamserver.net tcp
US 8.8.8.8:53 ext1-par1.steamserver.net udp
FR 185.25.182.20:27033 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 ext2-par1.steamserver.net udp
FR 185.25.182.52:27032 ext2-par1.steamserver.net tcp
FR 185.25.182.52:443 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 ext2-ams1.steamserver.net udp
NL 155.133.248.39:27025 ext2-ams1.steamserver.net tcp
US 8.8.8.8:53 68.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 84.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 20.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 52.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 39.248.133.155.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.4.4:443 dns.google udp
GB 142.250.187.195:443 tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 ipv6check-udp.steamserver.net udp
US 8.8.8.8:53 ipv6check-http.steamserver.net udp
US 8.8.8.8:53 api.steampowered.com udp
BE 104.68.92.92:443 api.steampowered.com tcp
GB 162.254.196.68:27029 ext3-lhr1.steamserver.net tcp
US 8.8.8.8:53 ext2-lhr1.steamserver.net udp
GB 162.254.196.83:443 ext2-lhr1.steamserver.net tcp
GB 162.254.196.84:27036 ext4-lhr1.steamserver.net tcp
FR 185.25.182.52:27038 ext2-par1.steamserver.net tcp
FR 185.25.182.52:27021 ext2-par1.steamserver.net tcp
FR 185.25.182.20:443 ext1-par1.steamserver.net tcp
US 8.8.8.8:53 ext1-ams1.steamserver.net udp
NL 155.133.248.38:27028 ext1-ams1.steamserver.net tcp
NL 155.133.248.38:27029 ext1-ams1.steamserver.net tcp
NL 155.133.248.39:443 ext2-ams1.steamserver.net tcp
US 8.8.8.8:53 ext3-iad1.steamserver.net udp
US 162.254.192.71:27032 ext3-iad1.steamserver.net tcp
US 8.8.8.8:53 83.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 38.248.133.155.in-addr.arpa udp
US 8.8.8.8:53 71.192.254.162.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 104.155.138.21:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 197.86.237.3.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 34.193.97.35:80 fwiwk.biz tcp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 udp

Files

memory/3688-0-0x0000000000400000-0x0000000000904000-memory.dmp

memory/3688-1-0x0000000002630000-0x0000000002697000-memory.dmp

memory/3688-6-0x0000000002630000-0x0000000002697000-memory.dmp

C:\Windows\System32\alg.exe

MD5 cfb4f102db0c1d9dde757a77d295369e
SHA1 9f5eaf5b76cce660c5d1163b7fd7740156d2742a
SHA256 8a3c0d9e79ce334c73f6f61d0d978f11d42c593ef30fd9030a5214f8d255e745
SHA512 881712dab4098fceed15a29a4c5ce32856ef9e6e8b266064291dac1a87a2a09dae613b65ff1ad22529d6d3b3a4a05dbe74b2e760e475562ce138b3c1036807fb

memory/436-12-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/436-15-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/436-20-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 f7789fb329b9b9f15dba8b8dbb34482d
SHA1 0caa9d05ec3c8c26376f08739cb712f1d46722dd
SHA256 1884029044ecddd5ae47c4b24f67859749a9d94ba4bc8ebde40ba6edd87e598f
SHA512 2cc8b8b54e8814436425dc01685aa3f76b3380951f4cc8270121ac55e6ea8a983ed95213b891f2cdb6f473d51ec846ee3637bf663b5f204e802c14582a91c1ef

memory/4444-25-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4444-26-0x0000000000540000-0x00000000005A0000-memory.dmp

memory/4444-34-0x0000000000540000-0x00000000005A0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 18f3763b70e11222263ccbf2a079ff32
SHA1 ae742eda2b4b01d82f1abb4885a785e9ea4bd917
SHA256 d7978bcff4bcdadc809fdabc0baa5bf9055acddbb344e6da369ddd9b7819c17a
SHA512 0ab26a3d8181a2be192e25dfafcd4d58c2a889b357119bf12ce93a967a6a8a7998b4bdb0c631d9ddad1dd0bdddd04a830579f110d618f4b543b691aba230ee69

memory/1016-43-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 3eb84cf4c1c1fa434cf4155e33181ded
SHA1 33413b0545820caa8d1ba638423db438b03c6e07
SHA256 dbf4b991227739c888dc73ba57d35c0205b82f9134d191d4c8e9e6b141bc3b3a
SHA512 6987f35a7906f3259e7fbdd2d574e8d2c89f1beced26093d682c4681fc327f4333791a99750731fb322d81cfcb5dba3aa34a8d43198da73a269efb033cbeb814

memory/1016-46-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/1016-37-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/5028-61-0x0000000140000000-0x000000014024B000-memory.dmp

memory/5028-59-0x0000000000810000-0x0000000000870000-memory.dmp

memory/1016-53-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5028-52-0x0000000000810000-0x0000000000870000-memory.dmp

memory/1016-51-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/4284-70-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3628-80-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/3528-88-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 ad40bd07051c42f88b3f51bec0182bdf
SHA1 b0a5307e73d9528aad161a92f0ea5932de187b85
SHA256 fc60cf465fe6ba17ae9c4a563f00cc443bcbe65ce55c6dee5075c2d9ef88fb4f
SHA512 0d136b1a8ac89f6b052cbacb1d690e3c6a2792627f2662bc598eb1d5852ef27631d7f92e27de5e2f84589d859b1d47bdf6184afce6c795ae8a5e9ad4a86f79fe

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 a731369edeb1cc6aad63cd9935821629
SHA1 915f988571aae0f0ea58da6765863a580d13a760
SHA256 af2d8b9324f2d3b7a30c9125e990b5ac653c0254acfae47f810cd6ae0b9947fe
SHA512 f4b2a5029e0018594f1570c9736d269f7674bd2ab79fa371bed9de4d28b5856983b3e09ca4f6ffa520a8de19045c05e254c3791b2da3364339b5be833258112a

C:\Windows\System32\Locator.exe

MD5 2d5e713ef80f28a4c48bf7baba63dc5e
SHA1 eedd36025a86a9f1ee06dc51c19a97030f88794d
SHA256 b5e3a8336f7fd483789c2959399d1ef77aaf44a3e0f44bd68fe0f209e75908cf
SHA512 3d9f04c58bdf5ae811dcaf2791a5e8e94ebd314bdb5de1fa9be80243a66cd23ebd91575c67214d0340548db8f092008e073fdb324d0ddc769dd944a7e4d9499b

C:\Windows\System32\snmptrap.exe

MD5 4a276aeeb9032038f355925ae1ac7f4a
SHA1 84e30e8106bd25611f9c9ef4a5a15cbd1e58f08f
SHA256 eb1b9a245d803da0bdce21ba807b03a4eda35aece7ec9a21b9ce4473e6a12ee8
SHA512 59d8becaccc414001e5ea9ed66596ae7ea82401a730887a8ef618b39aa36cf1e0e28749f5c085539a6c69cb3476c09cab597280f5cb4592c4e4fba4e5ad6dd8e

C:\Windows\System32\Spectrum.exe

MD5 ee3b5429987e8b53db1e93d329559ed9
SHA1 71012aaffd2ba80e349af5e484b3ed403400984c
SHA256 d2ab987c68aff320afa0f18dbd1683abcfd9cd5491605fec6ababaef4db821dd
SHA512 15c8ae7fe8f5b70929ec9aadf8e4abea113822eea3d2510e12c43325d2ea1ec2f1912e7d70a4e445a77cf51ca9cd0b3ac94f4c6c6131d10d41e3e7c23e94ac5a

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 eb51858b6f660d25d37aa09f8524e8af
SHA1 2e172383d2bbdad613ebc8b7531fb2d0dd8c2eea
SHA256 9647a6c81b647471f76e950276c190e76461a2eb0a8ace167b601db0ac3901c1
SHA512 752216dc84c062ef1e5915caad8560bd144dc639531ea71cde1478c0b319df3ab63e7ee621a4f4112cce6c0cf0b243b8c21becf8faaf96f3ee0ab06916580a9c

C:\Windows\System32\AgentService.exe

MD5 e1aaa20ddab1d17c029e292ac2e51d0a
SHA1 589ff498c53011d36ef2c87f2bdd1d6a376d4a8b
SHA256 775b1a1c9c21e9c473013db30b7dd593993fd283e8f4386f42cce317e2b10518
SHA512 a24acefce66ea58f5bd3d10a39012f102f68236e6e67743ad5cb9c8ba86d3f77fffcbf189403c28351f178836e08147e8aabdf0e7a68cb635804fb2c7b5b17c8

memory/4872-207-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3828-215-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3744-216-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/1940-214-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3476-213-0x0000000140000000-0x0000000140096000-memory.dmp

memory/4496-212-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2148-211-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 12c4ef74aa9782a644164b305ea9cad0
SHA1 a52d6b539b1654b0b6149333b337e7422edb1371
SHA256 e0ff4fc88743fa4294792e5ab8aa29a9d50d2380d404342ac0965c0a479129b5
SHA512 e0f63df9f07208b5c1c7f847a122d76483b87c144871559754fa6edb8c8406fdee7dfa00b5c4a18653e7e2083d958b4b0f02e32eefdb3e6785a23722117395c0

C:\Windows\System32\SearchIndexer.exe

MD5 2cca94d6f2d0c5813f75b4892357d376
SHA1 d29684bbca9b406f2c016c02c8b064e58644a772
SHA256 666b2bf2dc295dbf1f23c168b4483146ec951b82cb0a75603c22716613ef9cd0
SHA512 28d1498fba036821f38e942f9fc4d5ad9eb90e4db9c97286572f6862c9aa07a91839d9274436ea8497c41c46fa7587030f7de6f91e963c85f95f45059d13e5e0

memory/344-271-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1260-275-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3180-274-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/3960-273-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5084-272-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 10f0a5d8b4161119883d6be0d5ac61e9
SHA1 572854f57f201d210542362483d1db4ad9ab63a0
SHA256 61d52d7e5a390a6b555c276093b8004b5e421d92b4af8d0223575fe904067d25
SHA512 d07d0a64c5d9e6c19db0ee2181bab005cb2eb646a638d1be182f3bd11a37e254fc7d47f3c55b25a6eef0038e80061115029a400607303d4938eb2574ed2cb9b9

C:\Windows\System32\VSSVC.exe

MD5 af43bf962e1fb6b05c17fe47fa3971be
SHA1 70a8d60b005c226a5461e4c0923e657b7b16a669
SHA256 4471e709d2958a52d8564d9dd3af61085a3637aae19e8735bc50d62b12912451
SHA512 3a8bc8958e2b1d8acc4c19c94cfd60a27d2844481b3af34e048ce9c9a4283f0bb4f459ca2bae653504638ce24d3e83209b092d3b30d39ba73b007b27fdb48a0b

C:\Windows\System32\vds.exe

MD5 b88b9413ac48565ac2b6a91afab75934
SHA1 e54821123867f5cf132b6b5c1d4dfe216377805a
SHA256 a4d518f2ce9dbbb969572e72ece6309b7858c02b1559016012dad372ede01b6c
SHA512 6bce5bf30c0f3a20641469fd9feff31cfe3182cefca8039d9a5d937e547a513b581d9f18512674cae4d9960ebfcfe8fa461026d23a87ff95fc487bbfc4301b69

memory/3296-210-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4632-209-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3688-208-0x0000000000400000-0x0000000000904000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 7373e5bbfadf7ad3db53d1735d825e65
SHA1 4ba589a66f253bcc239007df441cb119b9d8a6bd
SHA256 84f210f190c159beda119e92b4662d86a32412cb63d4ba93017aef84389a032b
SHA512 11abb3491bd909e8b08081576191cfe097549d05ea78497eff2dfe261a245d39ba81272a0c8079b0ee9661defdd98ee5e138b3a32db5cc73697a547cc94f0ed9

C:\Windows\System32\SensorDataService.exe

MD5 a459af34501f7a4f020ce11db34291d9
SHA1 37a9b3880e5bc5e22f601f0f0a6e925381e2c1fc
SHA256 f65969426b6bebf3c95a204ac290c8011e8d21749dc718f23b0f540852b54100
SHA512 a39746b5daffdafc21a514be7138a590f1128be58c38a275ff36b3a88728ae5501299a9bd6a1923999ecb83e1f354cd8346e5c38d6e390b03a79a7bdb9b37606

C:\Windows\SysWOW64\perfhost.exe

MD5 8c2e80e98c50a7b308f45417e6cf6e3e
SHA1 f5a504d8d3d06baacaeea23cd1e8d07064a80809
SHA256 37a78b1e6528be72b84ac0a45ca982f95eb0bcc32b9c140fa4423f04a53928c3
SHA512 5d9a76b71d23014df9c6e24e7df6746395e219bb533d360ec3269d60eed7642119651d33bd343995f17cecfbac2344c084027261d6bcf5643e64421b05d781c1

memory/1604-110-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3528-108-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4284-107-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f11e2405e3d785ad823acff08aa53a80
SHA1 49c5fce5e46df2c05fa223aee647d62e6a6e8f96
SHA256 07f5ed677703bdc67d34f43e22e3a15d3aa3eb7850534b6241718a27de9a3ff0
SHA512 5ba2f8ece7e78d084684c0c69b7b3e4c092351579a51d755f520cd008628672b59912db8378154f36b22eb6e445623b21c0020185a3dc364564b2cf49b3305b3

memory/3628-86-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3628-84-0x0000000001A90000-0x0000000001AF0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 9df103530164bf3ee45fe6d0da26cb52
SHA1 b0d3f3328542be6f0a02579cfb9295b20c2fef23
SHA256 d19cccbaca6bb2885b9e0c94a1d89162d0672fb91a6af0472d57c2b43217157d
SHA512 4d69fb49639613ed9deb326f1e8a0242d40e09f2fc43b0103e69841cb91eb0ba6ce8f03dfc2f81006d729644568f0283fa3e12d04f63ec8ee40605c8da7c6f83

memory/3628-74-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/4284-64-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 718d056077b5d13f5523c489ed533c08
SHA1 08234a57f7996231504c2828cbf25fc9d34d5720
SHA256 f917f4488d5aa480ae90edfc27d14e4a9473b65a02182fd82426b6f93a4b0d40
SHA512 0f1e8f13ef62562addce34f184169c1aab367018906e0e6a1b9147fdd8e00ec71188c2371663e48d2b96fa3007348e9e6d35205f7b6902f30a61058cfc012d92

memory/436-430-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/4496-488-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4444-524-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/5028-597-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4284-602-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1260-606-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3180-605-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/5084-604-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

memory/14244-12685-0x0000000000400000-0x0000000000904000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt

MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 ba7cf59fed5fba1ecedca61a13a8e85a
SHA1 0987a603d522d61eb50f5fbe6cbf1b5f3998bdba
SHA256 b0b71866b4e17e58be4101fe1166b519c931ba515cef745d81e65368e8f2e419
SHA512 cdce780bfea0f5cf20c98fcf7d738b603adc87054bb562f3e9ed386fbee4a2cbc523a1050aa2f22605162847d274a0cbfe18687db8e36710385739a3e28402e1

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 8af433d5a24564c13dbcfc3b017d224d
SHA1 208088d625b166c342d30b99d2ed0f8e51ecfabc
SHA256 c8ceb3948685d6879d81439e0fc460e6280919dd01401515c4f0858f0bc74fc0
SHA512 5ca12146e5eeb075667e101f24de3e177f389a2b48185481981ddda60d62800b30c8ed0b4ecd7d927629d4fa1a6e7e20d05ce1be916aa3994061443ebf9bab39

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 ab8a8a2e5f976c5ab34cba583ac36356
SHA1 1f8875734015e0ab64ee26efc6f8c40b5716d0f0
SHA256 36d600a651f8776d570d2ec7c0d0aeecc1774da6f656e54841a915f2d2d0e3d8
SHA512 2f754b9784586edd2ad981736710696c038ce247468ccfea7226ea4fced63d6bfe63a79bb92d14424d11fd43a738a3045f46a2973847a712122523693d0df9dc

C:\Program Files\dotnet\dotnet.exe

MD5 e0b642329e8162016418ac4f621159f3
SHA1 7a79926e60a9d7eca992ef1523bf4c87b3e179e3
SHA256 07ea4f5f818dded46339c2e9ec450aa1a43149034ab478dbefd24d18989212d2
SHA512 80156ad7dfce36f80da392856b1749b88b34f513e593ccfa562ec148d92a7d9ff165a4fd2decd42920b41b428d3e84cadaae0cb4780c16d026f31302417ce962

C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin

MD5 b5fb6a1a9bffc9d7bd0d16cb41bcd328
SHA1 e9ddfdd047a3090a9ea52e873ebf0e7607f6a2f3
SHA256 de844519aeb812eb5e1178b9837abf236de57d88668d792b2fb29f411bbd2cad
SHA512 6d0e4197a8e5eebe5cdf559dc0da3bb836359ca34b72de043ef2093a925c9926a241bf677208501eb3d228c0b77e4584e6c19b59136d58598f3ae5c7d878da91

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 95039c544f3474b299b9aeb1cee55a18
SHA1 64ee34960b6efa7eaf72dfd74f3d65182fd59715
SHA256 64406a7689dce92bc7e6a9a3988118a0f77128f2c46402adaaefd7654c745486
SHA512 3921b0248851b49cc20844b8f9b861b1e9000c0c13c63ca12f36ff2777d23a763744229ffbdf05fe8a4eae8fbefc242fafb7ea17092aca303dd0c08d9f93aa35

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 1836409500629c08e958dc3ad40ec300
SHA1 1552ffd9e779552d60591c6f0874c9692eb37409
SHA256 460d0d3dcef45b54431ead8367bf07a12e303293f1802d57ae3eb661c9900899
SHA512 5c4016032cfc5921ee681d59cea0b739c8f668437c3b46771399b154bc33ed46152e75a7c5cb16274bae1b0151adb5859d682a12f2ef5c3b894d4bdd6708132c

C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.installed

MD5 10f9e89e442f565957d2af08b2b74047
SHA1 8132cd3763cd9200bb0fb7600cded8d60d6cd9a5
SHA256 3ffcd73d5e6761b05be12dbbb07d3baf64f2680f2931d4acea288bb4d48e803e
SHA512 e69a5f1fd04ff966179b185d4e4c82bf223aed29b0a67044509e33b2d4745d677bb7697e47b419205478fbef9a6903d50469d7ad41c302b4cfa9506180a8d50f

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll

MD5 a2317c5ce4c82910c7f4e97d48af645a
SHA1 67f5034a905cd1ef0c2888fd2cc40c2024d0848c
SHA256 363c1cc60b8cf09f026ffe4d6dabee37021f37d5719fa55ab807d56613e30b90
SHA512 35be28f55fcde4ad140fa089ee86aaeff3e90f174737474dfd502925313225db393a3e27eda0b44d9bee831ead48a24e803c35884842cee2946d558650b6f8f5

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll

MD5 a5707e6342e22d92ef8df839783d1716
SHA1 642c499b65382d883f6f9381fa204ba8d08f1f10
SHA256 fbf7e43884a1fd8adf167a5cfa4319339e2dba84515ec4487e074decc9afb206
SHA512 33a5255fe6b46d228cc131d27479d272342e88f12d884b841751167000e2c6a9c08a996526580a8466e957f4696d2400baf5d2cc2b3e5f8ea23ae3803d684285

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll

MD5 ee9e1e1af17a74d23438fb63f6b66395
SHA1 11f60e073257560f5f3dc8943e854bf2eac36ed2
SHA256 8587505e511503127abb7e5c614853b7848a489d96da0a95bc736dc6c3097a5e
SHA512 aca34604580214291d1ea62765ecb280c6eafad7bf8967af8c268d2daff84f783dafec8ed334ac051ad61a14fc3128dc3f396116b9c6413a288fbe7bb099a202

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll

MD5 72dbf67f86c95cdef31eaaef5861a00f
SHA1 18134f00734a2255bdf9bbc777045ac2d4f2e2f3
SHA256 5c74808c61ca8b6acb8f74813fb116341b18c27e4a654bbdd383b9fee3f33d36
SHA512 e0bbcdfb658ffa70b047cfd84a0e8a5613530ed0a34cc9ac365f69e253894db4b6fd059ce02627c201c1e9efe0b98aaddb70a641ce297677d3f9162838fdd1f3

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 a78aabc0f9a9dc5b9923d2ff67d24f23
SHA1 3a0330b84c7ca674f0710c10eee1e5126d545429
SHA256 39e98dd2cfd15b1687f3a8f8690a80026af0deaba5142c0fe503bbebca46d4c1
SHA512 3efd9fd95ef6aa16172c3d89150d49611c21deaa13fd50c2114e76380de573255ec6bdcfe10665bbe15a17c1d05ba327ca7ea24949ad1a173b3db86bab24adcf

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll

MD5 df9bc6c6936655ed05180de600916f3c
SHA1 abfd6dc420368aaee7d3ce11cca36af3cb4446f6
SHA256 b34fda7a50b20aaae509d0919ced53d718afb997a2bd9f3b97446c3cebf994d6
SHA512 b6d935a6046a573df8c0a7bafd57c35f333f74fbe754e18de13cdf9a39fd9649449030539b208046651d648eca20e4b5d0e73a8a7d173d6ea37bbfc311b0d6df

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll

MD5 880c1094ab4679600f77012712fcfdcc
SHA1 d92636752ceed77e4eb37967306de746953e375a
SHA256 65e57b5316eee1433c006adc6487c3ad3e17412b1a6d5a35ba518aaefd871bbf
SHA512 de8a622fd97bcd0a429c7a0874fc6dbeacb966e406dc519448ddfb420f584686a7a5ef105b4ac45a3a8de3bf0b7ed5b79ed62a92ebfceea3bceccce7298af652

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll

MD5 0b2450ac7066b1aa6970cd4763bed6a8
SHA1 9cdc98d8a852c5e66c42e83edec21a1a2ab1d347
SHA256 9e9ee99c5fbe9a2a784d324b4bff06842874dbc33320c1fb02f063060d2d5c7b
SHA512 a1e0b0dee99c5d4ee03f15fa69436f41c965438b289eb244c8bbdec2de4b439e8ea60417ca6a37064b0aff023fbae5debb732e5e69027ca86623514520d6dffd

C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll

MD5 9c2202f9ebd8d2e8c90c93d3b0f433e1
SHA1 3d20c8f8428df16372e7de91a6d4f94b80aefb4c
SHA256 894842053591d4818bac9e1e476601cf39e4191b4bd0748ccb9f3c2711caa946
SHA512 b274b3f3dafd290f72351b36b9937445e78b6a16eb6cfa9a0b6de3cf11d5d809cd5f4095c2c4a05c16bdd1fb1be0b883e4c387ae8f7693eab958a63ce408097e

C:\Users\Admin\AppData\Local\Temp\bin\audio.dll

MD5 cbc43e3928d5fd556456f8f9ef285063
SHA1 33c043f63171ddbbe58a5031961cb5040d1a245b
SHA256 ae99258ab7694026147b259367ef82d8ac2b118f87c02c7a41f81b82d1f7a9d7
SHA512 0d13bebbd71e48a1dffa34ad68e2a76746b3d745529842aba594b5de4d1a621f8759a2968cd61d8dfe9780a9ff23e808b6c90d63957e6ac2f95bf1ae0bf4b3a6

C:\Users\Admin\AppData\Local\Temp\avif-16.dll

MD5 a09c5fa842fa4456a0b53b46f1050225
SHA1 9e4677f19e77bf55e7d0e2e82d8c27f79dbbd78e
SHA256 3d7ba6fedfdfd6e751693d718a21438304690b754d1c5d13c847a829b2423b8b
SHA512 71c962da6ed6894209891513bf9f0132a5eab6c65a5d9ba334efcaf73463be5625665a060863a106d59fad1949f6191f641aa4c59ddb0e825701bef08ef9b5a5

C:\Users\Admin\AppData\Local\Temp\aom.dll

MD5 d764264518e77cc546a5876c3bcebad4
SHA1 ea17d45b396fa193a851bfd345e2b2c20ad60e12
SHA256 e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd
SHA512 7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 408d00f379d50046a43bd1b7be9fa02f
SHA1 0e7ab60f426b0cc8cfa77932c2f382650fc8cd86
SHA256 14ca6a896eb0a8d2e310899d9b9737e2be111d4b252490420924e151faaaf088
SHA512 982e3206f1d4d41db4c96ebb3cd32631bfc3575a03444467191d60e2a79964b9f590fabdaeae22b0347f19d98ee8011230a8bc0414ece5ddd26706ded576ed0f

C:\Users\Admin\AppData\Roaming\521dbdb1c3136770.bin

MD5 c5573b722849a26993a7753479f88632
SHA1 f30f0e6721acc51e09c3b5cf1033ca071364abd5
SHA256 baa95466e0095bd5cf385544eb736bb22d04f72f3fec00fd0315cc4731c355a3
SHA512 ef30c0df421342180f751a3903d574f484cc623f259c2c564d7f53ecc8fc8d70aeb7c9b985a6e8de29d8b472c675cb3e538fd185f34b27d0b2c19b05e07422f9

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 5998729c6ca6b9cd42b1d7bb723216c7
SHA1 b1b4627230315f449eae6a5e76076ba93eb03e6a
SHA256 34f10cc9c299570258d36504e380d9f277d37dcaead8e4ae2c9ed4476d240505
SHA512 3a967a7cd516ee3d212659823100ad9b43bd20a99c804402f71e4f01241dfb3b06a3e799933828c36989f0c9de31df44cd016803fb258a2e1af33970a1f1a0d2

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 8c9e85da6417ed1fc6deacebb2e3eb75
SHA1 14084131d6a1ee5ce5d0d7f9bc3006c973d06ee8
SHA256 0b480034080729fb7bff5281f101be59c0ac11f16ce1d762f795684e3ff83c14
SHA512 dc4cd64c2c5c101c267d05195207b83bd9cb801d6137c01cd3f4cebad4c8979820da0c6ab2eb748c2de0d82c7a84232dc927f923a8200121a64ecd0ba30c607c

C:\Program Files\7-Zip\Uninstall.exe

MD5 d591512fd67ffaf0650fb8b4dcef8b95
SHA1 c1a88e35620c01a8d0c05ce5cd4449dbb8ba9420
SHA256 69a15060eb9fb75d2224783a58f0270df6a7a8fc3bc473a9d8b20cbca492238e
SHA512 c1958b09ca15a3932fa7de1f4d6dce154bb2ee6fb462bbb8b61bdcbdfc09a5d177506a5e23c489e593e8eedf7decdd0289463a199e8d1a308636f715bcbb6e7d

C:\Program Files\7-Zip\7zG.exe

MD5 857f2ff0044ad9be5853981c783eccf4
SHA1 bfbe3f18d7b0d84b7d3c9a1ad40d36c49c90c302
SHA256 6c19ea44447c24cab29b47c6411cc29c3560a72d398798818a26e5a28f00409d
SHA512 2003b179f88f8a468bb1016468a8f49fbc98861c5293b7e3e29840f6cd16ef1e892e230e8d5738f50edd069e9d7d1e80860aafe56d66805c90c569b8195c0c47

C:\Program Files\7-Zip\7zFM.exe

MD5 31bd7cd0f051c05e7a84807035a10476
SHA1 697202c35a6f0f134194d640da7d4d7a602ce016
SHA256 5f6596f3f050923504e0a26997882ac4f4d2dc84cde391f044a3d82f3cce9e1e
SHA512 b92ca50f9a7c4afec504cd1cd6cf0f67d602f9864e061e3c47c2fea993452717dafd98a650babcf24b388573faa177c8aaed3770782d6e1b9c098c2cad0f7706

C:\Program Files\7-Zip\7z.exe

MD5 efb0363957a8fd4d793c65a80d453f6e
SHA1 1868a45e71fcea21f43566f5120411f628f9f98a
SHA256 6d9b178454da8cf8bf69193f3625dc3b342451401c0147165b14c7be34571565
SHA512 bc6562c8fed32f16f5edac79f3cc5b061b22314eb3b688f264aed4c9c0fca3cc7581eaaa5b5e8a876282fdfa6939ad2dc96ef27214c9d758f13758f7bdd5f9c2

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 8da553ef7f4ecf8692bec03655310b17
SHA1 cd5ed68e83ec8daa2abe606aa1c6327c690a0d9d
SHA256 e988878977350c62c89b960dbbedfc860bf2c7c4ab48a95e117a541af82a84dd
SHA512 37a6c0a80ff7b14f5e48c22425c861272f5df51dd214e6b649730e5175e41c4b9b913e5eb899c2ae4ad3bea9f0e9ad576d9137a57c54ce2a6fb9243410432e72

memory/3688-12707-0x0000000000400000-0x0000000000904000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\crashhandler.dll

MD5 9667216fc56106299cfe0474afdeaf39
SHA1 38b0768abfcd617bd8db59431a9525d789c84f83
SHA256 b056457b66dea391772a655ba03871180160314df68768f43b21c3cedf9d19ed
SHA512 a3c02500299e433ada5de7cc12bb05ee6b947ce363d355bb074a5525c68ccf0ccf46b5732262bb56e88f4dc2a0e32d4d577858c48a742a63745be8c3f018bba1

C:\Windows\system32\SgrmBroker.exe

MD5 9f83ce2cc27181711534960990737292
SHA1 9f93ddbed38b36eb887bdf8083d2fb0d6dd7838f
SHA256 783e08f3cec167b049ad2bc5547b0ad37d3fbabebe9263053e9cf10f0004dd07
SHA512 3a8b9ccc67c9848d85dd73e0aa3b7f6739c6ab69ca54b1e86fa168930dfed52c2ddeb63135d0099d94eb17fbffa6728f67f4c934515850900231950c0af1ceba

C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest

MD5 93e69eae544858aa33c9c1f6d48c4a8b
SHA1 f8b18435ceaad470bd809f02ac2934a5926e6adf
SHA256 7c569ccef088133b444f049ae07a8b9e6bdb78ef1b00ccfc6eacbf7b23619b3c
SHA512 cc4256ea641a41c31bce7ff19d4a5dc50a3a123cd039dba85b70549dcfdd9798024a258dab1be734165a89fcd24792d623f064ed4a639567f68b57b864d2be8b

C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt

MD5 3286b091e48bda782618cffa3b012ac7
SHA1 48a20a4062acb7961fb22e76e52081b36bbe61aa
SHA256 d1fac24e9be588bd765263c4699710d15f3516b207d7828e270968d3268ccc33
SHA512 853b292b629f57c894db7c1d482af374cb25262d606ec2c59f7e931362e20870ed432aecce23b0b3b444a459a1a585046752450be6e13499cdef2b11230aae1a

C:\Windows\system32\msiexec.exe

MD5 d631c86241764b66e2518f17892545f3
SHA1 7affd2b257bbf56d3b393198f0d4e668e5420784
SHA256 1c10a3f92d3eabc1f3990022a864744281433a6afa92bfa365535d59a5aaf1ef
SHA512 71ce5e019e8353465b180c682bb8bba233d9cf63370697bbbc246468d030e649ccdb10cf01f881576f73bbb6dbc76d35ec0cbceaa9bf2282b08f2a93003ae917

C:\Windows\system32\AppVClient.exe

MD5 81d4ca1ab4bf37029b9e1a735cd3ee63
SHA1 337a176a28b39eb98b146a1ed37434b15afc0fbe
SHA256 7b370b227b5d52ecf62c9dd566f010fc97c1f1e7b53b80817731b0e886bc105e
SHA512 53a60b24e46ba0db8823a4d66a6b92ece786a6c26e0a408b9471c9e15c970e047293388fa1ebb927287c2392da63aac48c7ff22d9e85b1164cf5a33ad446a27d

memory/6832-12761-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/6976-12779-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/7224-12785-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/8068-12799-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/7824-12813-0x0000000140000000-0x000000014017F000-memory.dmp

memory/7824-12816-0x0000000140000000-0x000000014017F000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/7736-12858-0x0000000140000000-0x00000001408FF000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

memory/7776-12860-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/8548-12862-0x0000000000400000-0x000000000049C000-memory.dmp

memory/8716-12865-0x0000000140000000-0x00000001400BC000-memory.dmp

memory/8716-12877-0x0000000140000000-0x00000001400BC000-memory.dmp

memory/14244-12888-0x0000000000400000-0x0000000000904000-memory.dmp

memory/8752-12889-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/8752-12899-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/6832-12917-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/7224-12930-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/8068-12933-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/7736-12937-0x0000000140000000-0x00000001408FF000-memory.dmp

memory/7776-12942-0x0000000140000000-0x00000001408FF000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 e826d9e0468f19f2691d94dba32246e0
SHA1 46d74659a655d3241b6bc2ef42a778bc42f60091
SHA256 8dd898b52487a612ff0c753789e2d2039aba2f5fcd7b01d7afd13f57603faaef
SHA512 d31ebcf0bd0ea6a3ee41565828ae72affbfa6c9fcc50f3e19ae2ddacfb3e770c9c972a5abc70c16e92f1b747001bbe268e409615a28068cea5ad975c7786dfa2

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe588fb8.TMP

MD5 5de732b8c96404d45c2d04e10eeb5cec
SHA1 64fb3d432a306a364ec3bbe6d8b834c1b14d510c
SHA256 91952841965f1391bd91daf93623465a9b4801c9420529150d5a300154db3157
SHA512 af5bf0603556a38a311412da60a76bd7973a44376597d8b4d6770d08f9c0b97e15fa299eb5801577a159fde9a9f8ddd4445a35bbc7951a5fe8c01fadebedbe48

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

MD5 8971c39ec098db262ac752d3ae5ce44e
SHA1 20b476a37e5a85b6539ae88ec75042a19f10d6db
SHA256 3ce1938a192873b3cc39ae004a9b090468b697e977cbae524d43bdca57945672
SHA512 e2ea62dd42e4638f01e6f67840690e292a89b0f6381462a6686d4d93f2fe07393aa433a8de860f8381d3a441b95cf04ea84c570e9c5ccd2f87ea0f51237be3fb

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe594397.TMP

MD5 f1b5adc9c264a0dd2a8d7180a767f8cf
SHA1 0fa5c8c88d35a73edb267b76034710cf46c629bc
SHA256 718454c8d95c17e08878e44f055749ee72a9376c6e7e73387f6ce1d0863db84f
SHA512 02d4fc20a0bada58dc4c793c9f27b895f2341b054c27ad4cdf8a68b2f090f314b7e2cad5e2f44ffdf84bc20142565be5ef01bd24c2cffb52c851fe7b02bbee6a

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe59579c.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 540458c0bad774d09682015f06aa5623
SHA1 4a260dcbfd1405c1d29b49301f8f5177a2e14f02
SHA256 f7d398f6ec44f415fd56af725f541adee90d3786e8b99c04b1e9e4fe0557bc18
SHA512 51117ec4987ee357c95df470d94cf5111ccc7566afdff74db9192f24ec3c1e1c587fdc5cc6c6e26bf74b2242fe55a0cc37214cf1345b28cb893a2695d59059e4