9feac0a3f22213ef863d4a65885c4521389a8322cf92120588c110db172879a0

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MagpieAuth_1.3.2_x64_en-US.msi
Size 5.6MB
Sample261102-db5pcsss3p
SHA256 9feac0a3f22213ef863d4a65885c4521389a8322cf92120588c110db172879a0
MD5 faf12db6f6b0c0562ef9eb0e57e53b0d
SHA1 61a956063f6136ed75b7e81133032c12ca7f8e6f
SHA512 45c22eb63a340617b3519882edf0228fad1b708879fb855d6cfb50a657182d084925ca94fe54fe05dc9eb642011399fea141383344e7883f107e1f1a3e958ee9
SSDEEP 98304:j4st1Exz8bbOhyclzUhgIAnEGV32CG+qqhKty9OMDhQqAWuba1edrOQgm:jNt1Xsv4RvCG+qqM4cMqlb7rOQ
TLSH
T12756334F7FC5A862D46A2E35613AA360C6BCEC542E156887235D7A1CCDF02D02BB5DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	magpieauth.exe

Loads dropped DLL 1 IoCs

pid	Process
2672	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	magpieauth.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\MagpieAuth\test_keyring.exe	msiexec.exe
File created	C:\Program Files\MagpieAuth\magpieauth.exe	msiexec.exe
File created	C:\Program Files\MagpieAuth\Uninstall MagpieAuth.lnk	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFAAC0B1A12AEB0D46.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI159.tmp	msiexec.exe
File created	C:\Windows\Installer\{F8395D6B-10C3-4E45-AFFA-7282961C511D}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\model.markov	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{F8395D6B-10C3-4E45-AFFA-7282961C511D}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7ED39F2EEF390F06.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59fbbb.msi	msiexec.exe
File created	C:\Windows\Installer\e59fbbd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\surnames.txt	msedgewebview2.exe
File created	C:\Windows\Installer\e59fbbb.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F8395D6B-10C3-4E45-AFFA-7282961C511D}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B442C9388B791EE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\english_wikipedia.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC73A43FABFE27FC.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6076	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\PackageCode = "3FBC359059506944F8882F704AD370FA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6D5938F3C0154E4FAAF272869C115D1\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6D5938F3C0154E4FAAF272869C115D1\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C89214DEB7DEEAF5CB601745B3DB6CE7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\PackageName = "MagpieAuth_1.3.2_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6D5938F3C0154E4FAAF272869C115D1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6D5938F3C0154E4FAAF272869C115D1\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6D5938F3C0154E4FAAF272869C115D1\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\Version = "16973826"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C89214DEB7DEEAF5CB601745B3DB6CE7\B6D5938F3C0154E4FAAF272869C115D1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\ProductIcon = "C:\\Windows\\Installer\\{F8395D6B-10C3-4E45-AFFA-7282961C511D}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6D5938F3C0154E4FAAF272869C115D1\ProductName = "MagpieAuth"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5624	msiexec.exe
5624	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3560	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	5624	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6076	msiexec.exe
6076	msiexec.exe
1480	magpieauth.exe
1480	magpieauth.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1480	magpieauth.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6076	msiexec.exe
5624	msiexec.exe
2672	MsiExec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 2672	5624	msiexec.exe	90
PID 5624 wrote to memory of 5408	5624	msiexec.exe	96
PID 6076 wrote to memory of 1480	6076	msiexec.exe	99
PID 1480 wrote to memory of 3560	1480	magpieauth.exe	100
PID 3560 wrote to memory of 2212	3560	msedgewebview2.exe	101
PID 3560 wrote to memory of 1788	3560	msedgewebview2.exe	102
PID 3560 wrote to memory of 1788	3560	msedgewebview2.exe	102
PID 3560 wrote to memory of 1788	3560	msedgewebview2.exe	102
PID 3560 wrote to memory of 1788	3560	msedgewebview2.exe	102
PID 3560 wrote to memory of 1212	3560	msedgewebview2.exe	103
PID 3560 wrote to memory of 2552	3560	msedgewebview2.exe	104
PID 3560 wrote to memory of 2552	3560	msedgewebview2.exe	104
PID 3560 wrote to memory of 2552	3560	msedgewebview2.exe	104
PID 3560 wrote to memory of 756	3560	msedgewebview2.exe	105
PID 3560 wrote to memory of 756	3560	msedgewebview2.exe	105
PID 3560 wrote to memory of 756	3560	msedgewebview2.exe	105
PID 3560 wrote to memory of 756	3560	msedgewebview2.exe	105
PID 3560 wrote to memory of 756	3560	msedgewebview2.exe	105
PID 3560 wrote to memory of 4472	3560	msedgewebview2.exe	108
PID 3560 wrote to memory of 4472	3560	msedgewebview2.exe	108
PID 3560 wrote to memory of 4472	3560	msedgewebview2.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MagpieAuth_1.3.2_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files\MagpieAuth\magpieauth.exe
  "C:\Program Files\MagpieAuth\magpieauth.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1480.2300.7101205717224005579 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView /prefetch:4 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa690a5fd8,0x7ffa690a5fe4,0x7ffa690a5ff0
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,17204523835150103883,14292675489296706395,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1764,i,17204523835150103883,14292675489296706395,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1764,i,17204523835150103883,14292675489296706395,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3312 --field-trial-handle=1764,i,17204523835150103883,14292675489296706395,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView" --webview-exe-name=magpieauth.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1764,i,17204523835150103883,14292675489296706395,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c804cd9a6fd91ed94d8c4d31fcdf6712e48a22a4
      4⤵
      PID:4472

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D3A02D6B945EEE9F66CF0A98871AE6E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2672
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59fbbc.rbs

Path C:\Config.Msi\e59fbbc.rbs
Size 10KB
SHA256 02c960a5c566a20cb50c464274cf223c81160be67dfed98e96cc57ce60cf07ec
MD5 b1764fc41447bf8e8f1756ad8af995e2
SHA1 01fff9a52c0324129dbe323b534ec17459764bd2
SHA512 57171ae7257984f0cdee6301f014a7fd8446417f427da60da27c5ada5889d2b80feda5380b08c9fb03a7e5b68cbc61a22123d0c1106a1bf845b5cdecd0447622
SSDEEP 192:T0nnF+CWCX4L9M/GiM/MIq4xb9Fa9TE9pAW9bi6QlZcltpReCDn4xEG7:T0nnF+CR45MHM0IqGZFYTmpb+6QlZc3Y
TLSH
T16522CC82A710C1D2F8962B74CB4717153BB7C28A8705530F189D95B89F93BD41FE6B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

magpieauth.exe

Path C:\Program Files\MagpieAuth\magpieauth.exe
Size 12.8MB
SHA256 2ee53725529a9085cc86e154479072e753d2595cab58d21d755b914fa68c58c8
MD5 8aac4e73d51c7c0cdfab4e69773f1190
SHA1 8681a2e95113f432f066127e7977d0bcb28fe3fd
SHA512 3bea8febe4349390c7e57375805fb2f0ec1fffb46af03ac5867e864b3cdc2a350c614e949c18e7ab0937c75cb2352e854b84bb87006c56f08920ed2192d4b256
SSDEEP 196608:ks/RAZSQRApAplgI8xAnIZMzlu/VuoESaywRhJI:kERAZSQRApAplgI8xfuobaNR
TLSH
T172D607257A9A996CD09BC474834B8A62497130CB1B35B9FF4494963C3F6EBF42F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MagpieAuth.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagpieAuth\MagpieAuth.lnk
Size 1KB
SHA256 d7374f5b76687bd70d3bdee0bbc2060081ea945ad0ad4c9ccd7d73b07cb22b3f
MD5 ae00e522a542432805820b4cbdb770f5
SHA1 1c860bf4fd6db430cb0164e23237cb3cf13d63da
SHA512 ab2308058a50bd6913d31c4e4a12096006b50b4120ea2f585f57cdabe76fa4f8e527a90c8c3e82dc24dd059446b7b6700ac205ad76e2678ab23aba1ca585acb1
TLSH
T147410C0117E16B2EF3B3B7361F3006229B7BFC07F2508F2F4182068948E52009926F2E
MD5 SHA1 SHA512 TLSH

Submit Download

~agpieAuth.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagpieAuth\~agpieAuth.tmp
Size 2KB
SHA256 c55bdb8d7bc0f163026c00b09b7c1d2dd6ac428ab9c8fbee157a54048d37188f
MD5 082ffb9dbb10581dff9ab33495a3aca1
SHA1 10c426cb2e57bf3983a7d27be8198989f1204e3e
SHA512 32583ffc2006904984c01718612ecf2c6ebb01f65101e69c868ce1a845c7cd55ebb535782b6b27a420b26d3f0f9e0e6c73442e4040260b1b6ad11da8d1e62c8e
TLSH
T17141FD0257E56B6EF3B377361B304622877BFC03F2548F2F4182068918E92409A26F2E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9DDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9DDC.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fc25720-42f5-4c2c-829c-76d6366ed2bb.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\5fc25720-42f5-4c2c-829c-76d6366ed2bb.tmp
Size 15KB
SHA256 43338777799a6221dbb72d58e863c366869b1b923480b623441278b663e3edea
MD5 31d8552192cd492e76532c8f857e6efb
SHA1 f39f56aecd9584f7dc1552287f6b025c55f544ec
SHA512 8856678c538a13719d704486e1555bd20b422e52b4bc8fb29ea1b112b9e470825746c70f13e96723a35f4d2ac8a9b358cc647711f7c59c3431f0546571526009
SSDEEP 384:k+OBqImmJvGBLx3NaFMJFNNBS9md7IAg6rN:1cvGtlN3yeR
TLSH
T15F72BD762C266E773CF7C508BA8A374BCB655293C0D67BD8CDEC9F0E516B0841392911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f707a1d6da96cc96143834cda21d699fb57772371c908611b0caed1e333e73cc
MD5 ceda8158b6ecf8ae440a867bf1651d45
SHA1 47c406e3a9d9a016e4149e784d188787ae154c10
SHA512 e4e237ca957100cf0cdb3a226dcf9bffab6375a0139b346f8fbc10e6efff35d4079eb80f4c08365e6fd88571a7c44216f1d572f472aac46001fd72505bafd60d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a08535f3a5b52945b470c6b932fdb907a28c4f6e02330444c87542aab3c72c4
MD5 74ecdbaf2b22db19bf460ccab43cc5ae
SHA1 588785fcaf67ba2ac853172b446cee2485323e78
SHA512 89ed5b7d581783d2fe35c39c2390480454930c9f50cfd86bff23ab8c75aad8fcc6b4014fca66a4ee4d2ca1e58b3f3cda76896eed76a2f37d54163f24f161899b
TLSH
T17BD0121773024174C0102133000361490400C20B80464401D428961D2E654705A02892
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6b59dede-156c-43cf-98ac-fcb827678343.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\6b59dede-156c-43cf-98ac-fcb827678343.tmp
Size 6KB
SHA256 21c406cebb80d7d1a127cab8bf6957ad5c3503bd6c3030af5b3de8146b729a21
MD5 4c2e58b0577dbc579deed2cd968bc6b3
SHA1 59407fc09461476d80548a15dfe2aafe96f3fb0b
SHA512 c0e7f155910425fe781208600722fc219915f6c581551405df6bc9c5db35acca8de55205bf4de04ff6988932b7557b0d9ac84d7545ef7b1aa8413fb49fdfa5a9
SSDEEP 96:st+/d2FxHb9nkio5h16Z0js7/x+6MhmuecJo/1ejeIK+gth928XM1C7K:stGshRonjsV+Fdo/QjwnG6K
TLSH
T1FED1A6026E2479BB4CC7E519FA257A4BE3F9607261D12D58EBFC462C08DB6CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 5c868ae1e44343c88ed9324624d344f9599f610eb3e44018b9edee5eda39f321
MD5 844d6187a7e1fe3c35dde204c5ea96a2
SHA1 cb571ab9a139f3d304ada5f07ed8c84fb625ed19
SHA512 4c1273aab93a424eb8a301349a9b940fd33d285e7d873cf9119764bff87a71a4a3b7f865787472365a10d14e2542dc6d18732a0607951d78f3df81b08efe7be8
TLSH
T188B0112CA8B00000E22282380FCA02AE3F30083002338EEEE0E330FC8AB23C08A0000A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 69ebba4a268f6dfe276f2a4bd223a1d08fa14ffda9a5b4929895e074ed936575
MD5 4f64e6f2e800bcbc4f965716e171f6e0
SHA1 1fbb0da9e58fa28531117a308d8cc52961fab02f
SHA512 afd521de52c6d793adf62a1eb36f6e383e4736bd225a892080af91639b49537d3d31737d267b53d6afe48bd6e7fa91960b687442bd91b3076df00cfd740b07fc
MD5 SHA1 SHA512

Submit Download

500865d3-c1af-41ac-8ce1-8a6d1e8bbb58.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Network\500865d3-c1af-41ac-8ce1-8a6d1e8bbb58.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

b58f0d62-5577-4431-9021-70f24633cea6.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Network\b58f0d62-5577-4431-9021-70f24633cea6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\Local State
Size 1KB
SHA256 c71f2f3cd37bee236ea4d858dc51f9d56f8b7415d89ab0fa0951a827e9071290
MD5 226e0bf3eb99023685fbf3e29b45ecbe
SHA1 c774f52d0182e7a8116c73d9eaa8a8e7494eb1eb
SHA512 a2f9e1923283432ddc44da9774f787513336b5cf6bee2ff1486674fdbe457d73ae9852ab71124876e022ba87b737041f49bd578e3080184807583822ad2af4b2
TLSH
T1702192B2D4652F73BED32148A003BF5B8F301057C5A11E0066ED0B185AE714CD66DC32
MD5 SHA1 SHA512 TLSH

Submit Download

c0568345-6b5c-4c48-b455-38a501bf0113.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\c0568345-6b5c-4c48-b455-38a501bf0113.tmp
Size 2KB
SHA256 c9323df4589dbb32d99eb27b5a6f886da0cd19cf260d719406bc436394983557
MD5 9f304b04da3f203555d4ec5fcf3b89d5
SHA1 5e40c9b98a12bfc320bb882757789d0a5d82e8eb
SHA512 065884db4055618429144f3a952f47b15a2e4bcecd755f8b443a0980ead742eef48dc9177fd1d6c406a86f0f8c02a1001e605ae07544c55c101707f02993a50e
TLSH
T1F95194336C156B77AAE36608F84B7F27CF7990929AA23F109AEC0B1840D755C5385C37
MD5 SHA1 SHA512 TLSH

Submit Download

e0200f57-0ec7-4cbf-aa41-e97ed0166610.tmp

Path C:\Users\Admin\AppData\Local\com.magpieauth.app\EBWebView\e0200f57-0ec7-4cbf-aa41-e97ed0166610.tmp
Size 3KB
SHA256 3199d66cb4d517344779016a3e52fe25beba06ce82082d0c983ff1de3c553205
MD5 ccb015ea1423ac3f78a6bb5e6cb41e6c
SHA1 5ce1f435c29dcbc908629f3d82e9c023e03b5909
SHA512 3a2b12b3ce0ef5dabd6fd616366881b77b556429c66326534ebd9f1fc6b018ce26c168052643680ac86830d6d277625e86d66309f6cb05a29f114e12ec36eced
TLSH
T1886185326965A9775EE39A04F8863B16EBA55023D8D53F54DAEC0F0C01D729C1381C27
MD5 SHA1 SHA512 TLSH

Submit Download

e59fbbd.msi

Path C:\Windows\Installer\e59fbbd.msi
Size 5.6MB
SHA256 9feac0a3f22213ef863d4a65885c4521389a8322cf92120588c110db172879a0
MD5 faf12db6f6b0c0562ef9eb0e57e53b0d
SHA1 61a956063f6136ed75b7e81133032c12ca7f8e6f
SHA512 45c22eb63a340617b3519882edf0228fad1b708879fb855d6cfb50a657182d084925ca94fe54fe05dc9eb642011399fea141383344e7883f107e1f1a3e958ee9
SSDEEP 98304:j4st1Exz8bbOhyclzUhgIAnEGV32CG+qqhKty9OMDhQqAWuba1edrOQgm:jNt1Xsv4RvCG+qqM4cMqlb7rOQ
TLSH
T12756334F7FC5A862D46A2E35613AA360C6BCEC542E156887235D7A1CCDF02D02BB5DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3560_842008837\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ec982bff66ef542626faf59f41080dd4434731520a5d01c19dc9f90fe76576b2
MD5 2e59d750bd9e69f095016afcc4bac7b2
SHA1 9ce431b4d938369b76df28b14c821d6b087e585d
SHA512 c9df96ce89aa79402f678566c739cd816d983d324e0d6bffb859e07e2628ba0c22c6c7271faea78c1cfce7154df5b31f224db447b5120fdf5d1ea8727c7ec28d
SSDEEP 24576:eFo3DMPndoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:UHw
TLSH
T1BD57042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3822d768-981a-44d4-9d2b-512a4bf2069c}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3822d768-981a-44d4-9d2b-512a4bf2069c}_OnDiskSnapshotProp
Size 6KB
SHA256 1d535e66d83b360e93891de253d1be489660856c87df6a41151db4b80962dcce
MD5 8a76aa0028f2de479f65e7c722490951
SHA1 7204cdd6c0eb59a096700e9bb45a53e26b57a4d0
SHA512 da639b7ae7787300fc1729c459392f3b80c2a657125d8c3e538df88436bb704282946156217c9218510e681428ec338686c3079383fba36a5c8c8d6f3b9d5da1
SSDEEP 96:FZ6/Favc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:X6ob++uVm
TLSH
T13FD198085AF54711E2B3AB7129F18557A437B811EF33CB8E0198238E2660910F936F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-92-0x00007FFA8AA20000-0x00007FFA8AA21000-memory.dmp

Download

memory/1788-76-0x00007FFA8AA20000-0x00007FFA8AA21000-memory.dmp

Download

memory/4472-307-0x00007FFA8A7D0000-0x00007FFA8A7D1000-memory.dmp

Download

memory/4472-308-0x00007FFA89C80000-0x00007FFA89C81000-memory.dmp

Download

memory/5624-10-0x0000016FD24E0000-0x0000016FD2E84000-memory.dmp

Download