Malware Analysis Report

2024-10-19 08:36

Sample ID 240731-gzsaqazhjn
Target 3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb
SHA256 3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb
Tags
amadey redline sectoprat stealc 25072023 30072024 exodusmarket.io fed3aa livetraffic logs qll valenciga credential_access discovery evasion execution infostealer persistence pyinstaller rat spyware stealer trojan quasar office04
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb

Threat Level: Known bad

The file 3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb was found to be: Known bad.

Malicious Activity Summary

amadey redline sectoprat stealc 25072023 30072024 exodusmarket.io fed3aa livetraffic logs qll valenciga credential_access discovery evasion execution infostealer persistence pyinstaller rat spyware stealer trojan quasar office04

Quasar RAT

Amadey

Stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine

SectopRAT payload

SectopRAT

Quasar payload

RedLine payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Stops running service(s)

Downloads MZ/PE file

Checks computer location settings

Checks BIOS information in registry

Reads user/profile data of web browsers

Identifies Wine through registry keys

Reads data files stored by FTP clients

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Drops startup file

Executes dropped EXE

Reads WinSCP keys stored on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Blocklisted process makes network request

Enumerates connected drives

Adds Run key to start application

Checks installed software on the system

Power Settings

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Launches sc.exe

Drops file in Windows directory

System Location Discovery: System Language Discovery

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

Detects Pyinstaller

Program crash

Scheduled Task/Job: Scheduled Task

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Checks processor information in registry

Checks SCSI registry key(s)

Modifies registry class

Modifies system certificate store

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-31 06:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 06:14

Reported

2024-07-31 06:17

Platform

win10v2004-20240730-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1584 created 3432 N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe C:\Windows\Explorer.EXE
PID 1584 created 3432 N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe C:\Windows\Explorer.EXE
PID 1584 created 3432 N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe C:\Windows\Explorer.EXE

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\ProgramData\uhuvxdp\vkaqgg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\cmd.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\uhuvxdp\vkaqgg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2904 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2904 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3584 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 3584 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 3584 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 3584 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 3584 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 3584 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2016 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3684 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3584 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3584 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 3584 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2268 wrote to memory of 3440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe
PID 2268 wrote to memory of 3440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe
PID 2268 wrote to memory of 3440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe
PID 2268 wrote to memory of 4280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe
PID 2268 wrote to memory of 4280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe
PID 2268 wrote to memory of 4280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe
PID 3584 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 3584 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 3584 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 3584 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 3584 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 3584 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 3584 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 3584 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 3880 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 3880 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 748 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Windows\system32\cmd.exe
PID 748 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Windows\system32\cmd.exe
PID 3584 wrote to memory of 7088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 3584 wrote to memory of 7088 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 7088 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 7088 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 3584 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 3584 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
PID 3584 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe

"C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe

"C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe"

C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe

"C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1528 -ip 1528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 356

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI70882\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\ProgramData\uhuvxdp\vkaqgg.exe

C:\ProgramData\uhuvxdp\vkaqgg.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 85.28.47.70:80 85.28.47.70 tcp
US 8.8.8.8:53 70.47.28.85.in-addr.arpa udp
DE 20.52.165.210:39030 tcp
US 8.8.8.8:53 coe.com.vn udp
VN 103.28.36.182:443 coe.com.vn tcp
US 8.8.8.8:53 210.165.52.20.in-addr.arpa udp
US 8.8.8.8:53 182.36.28.103.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 109.120.137.52:80 109.120.137.52 tcp
US 8.8.8.8:53 52.137.120.109.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
RU 185.215.113.9:9137 tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 9.113.215.185.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
NL 91.225.219.163:80 91.225.219.163 tcp
US 8.8.8.8:53 163.219.225.91.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
US 8.8.8.8:53 111.240.92.91.in-addr.arpa udp
NL 91.92.240.111:1334 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 pool.supportxmr.com udp
FR 141.94.96.195:3333 pool.supportxmr.com tcp
US 8.8.8.8:53 195.96.94.141.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 vaniloin.fun udp
US 104.21.72.79:443 vaniloin.fun tcp
US 8.8.8.8:53 79.72.21.104.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 claywyaeropumps.com udp
NL 185.43.220.45:4000 claywyaeropumps.com tcp
NL 185.43.220.45:4477 claywyaeropumps.com tcp
US 8.8.8.8:53 45.220.43.185.in-addr.arpa udp
US 104.26.12.36:443 tcp
US 8.8.8.8:53 securesmtp.accommodationresearh.info udp
DE 52.57.42.102:443 tcp
US 8.8.8.8:53 36.12.26.104.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 102.42.57.52.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
DE 18.194.245.233:443 tcp
US 8.8.8.8:53 233.245.194.18.in-addr.arpa udp
US 8.8.8.8:53 mail.dtccom.net udp
US 129.159.110.135:587 mail.dtccom.net tcp
US 8.8.8.8:53 lesta.ru udp
RU 95.181.181.87:443 lesta.ru tcp
US 8.8.8.8:53 87.181.181.95.in-addr.arpa udp
RU 95.181.181.87:443 lesta.ru tcp
US 8.8.8.8:53 securesmtp.tammysmithphotography.com udp
US 8.8.8.8:53 mail.jlchacha.com udp
US 8.8.8.8:53 securesmtp.unimedci.com.br udp
US 8.8.8.8:53 i.softbank.jp udp
US 8.8.8.8:53 jefftobias.com udp
US 3.33.130.190:465 jefftobias.com tcp
US 8.8.8.8:53 out.m618js.net.pl udp
HK 45.11.76.26:587 mail.jlchacha.com tcp
US 8.8.8.8:53 kefgames.net udp
US 8.8.8.8:53 abv.bg udp
US 8.8.8.8:53 smtp.virgilio.it udp
US 8.8.8.8:53 mx2c38.carrierzone.com udp
US 72.52.178.23:587 kefgames.net tcp
BG 194.153.145.104:587 abv.bg tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 66.175.58.42:465 mx2c38.carrierzone.com tcp
US 8.8.8.8:53 mta2.spin.it udp
US 8.8.8.8:53 secure.arkadykaminski.com udp
US 8.8.8.8:53 securesmtp.bezzrealestate.com udp
IT 79.143.126.202:587 mta2.spin.it tcp
US 8.8.8.8:53 securesmtp.ahoo.com.br udp
US 8.8.8.8:53 kr1-aspmx1.worksmobile.com udp
KR 125.209.209.251:465 kr1-aspmx1.worksmobile.com tcp
US 8.8.8.8:53 secure.its.jnj.com udp
US 8.8.8.8:53 citrongastronomia.com.br udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mail.wbzk7.onmicrosoft.com udp
US 8.8.8.8:53 out.5dates.de udp
US 8.8.8.8:53 145.1.209.213.in-addr.arpa udp
US 8.8.8.8:53 26.76.11.45.in-addr.arpa udp
US 8.8.8.8:53 epost.de udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 mail2.mail-vert.fr udp
US 8.8.8.8:53 smtp.c2-studio.com udp
FR 141.94.139.121:587 mail2.mail-vert.fr tcp
US 8.8.8.8:53 smtp.frontiernet.net udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
US 66.96.130.141:587 smtp.c2-studio.com tcp
DE 142.251.9.27:465 alt3.aspmx.l.google.com tcp
US 66.133.129.10:587 smtp.frontiernet.net tcp
US 8.8.8.8:53 out.ac-dark.de udp
US 8.8.8.8:53 mail.lowfrequency.net udp
US 8.8.8.8:53 smtp.lena-dirk.de udp
US 8.8.8.8:53 smtp.email.it udp
DK 194.19.134.66:587 smtp.email.it tcp
US 8.8.8.8:53 mail.optonline.net udp
US 65.20.63.172:587 mail.optonline.net tcp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 65.20.63.172:587 mail.optonline.net tcp
FI 142.250.150.27:587 alt4.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.indra.es udp
ES 94.126.240.205:587 smtp.indra.es tcp
US 8.8.8.8:53 smtp.nettel.net.nz udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mail2.sfs.biz udp
US 65.20.63.172:587 mail.optonline.net tcp
CH 194.93.114.239:25 mail2.sfs.biz tcp
US 8.8.8.8:53 securesmtp.jhc.com udp
US 8.8.8.8:53 mail.talaregroup.com udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mx.generic-isp.com udp
NL 142.93.237.125:587 mx.generic-isp.com tcp
US 8.8.8.8:53 out.efe20.de udp
US 8.8.8.8:53 tianya.cn udp
US 8.8.8.8:53 smtp.citromail.hu udp
DK 194.19.134.66:587 smtp.citromail.hu tcp
US 8.8.8.8:53 securesmtp.hallmark-aviation.com udp
US 8.8.8.8:53 aspmx3.googlemail.com udp
US 8.8.8.8:53 mail.supratecnologiarj.com.br udp
US 8.8.8.8:53 121.139.94.141.in-addr.arpa udp
US 8.8.8.8:53 141.130.96.66.in-addr.arpa udp
US 8.8.8.8:53 10.129.133.66.in-addr.arpa udp
US 8.8.8.8:53 66.134.19.194.in-addr.arpa udp
US 8.8.8.8:53 172.63.20.65.in-addr.arpa udp
US 8.8.8.8:53 125.237.93.142.in-addr.arpa udp
NL 142.250.153.26:465 aspmx3.googlemail.com tcp
US 8.8.8.8:53 email.tst udp
US 8.8.8.8:53 mail.factoryclub.fr udp
NZ 203.152.107.121:587 smtp.nettel.net.nz tcp
US 8.8.8.8:53 smtp.e-professional.ph udp
US 45.79.222.138:587 smtp.e-professional.ph tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 8.8.8.8:53 securesmtp.student.riverviewschools.com udp
US 8.8.8.8:53 mx00.ionos.de udp
DE 212.227.15.41:587 mx00.ionos.de tcp
US 8.8.8.8:53 netflix.com udp
IE 54.73.148.110:587 netflix.com tcp
US 8.8.8.8:53 secure.sandcars.net udp
US 8.8.8.8:53 smtp.sagame.christmas udp
FI 142.250.150.27:587 alt4.aspmx.l.google.com tcp
US 8.8.8.8:53 novec-ma.mail.protection.outlook.com udp
US 8.8.8.8:53 securesmtp.net.ca udp
IE 52.101.68.5:465 novec-ma.mail.protection.outlook.com tcp
US 8.8.8.8:53 maxwinslots24.xyz udp
US 8.8.8.8:53 mail.kconline.com udp
US 8.8.8.8:53 mail.ltevjy.com udp
US 3.16.16.216:587 mail.kconline.com tcp
US 8.8.8.8:53 infoarta.com udp
US 199.59.243.226:587 maxwinslots24.xyz tcp
FR 141.94.139.121:587 mail2.mail-vert.fr tcp
US 8.8.8.8:53 mail.bullex.de udp
US 8.8.8.8:53 igti.com udp
US 50.28.61.178:587 infoarta.com tcp
US 8.8.8.8:53 mail.optonline.net udp
US 45.33.23.183:587 igti.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 65.20.63.172:587 mail.optonline.net tcp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 121.107.152.203.in-addr.arpa udp
US 8.8.8.8:53 earthlink.net udp
US 104.19.239.228:587 earthlink.net tcp
US 8.8.8.8:53 mail.techtinker.com udp
RU 185.215.113.67:40960 tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 76.223.54.146:587 mail.techtinker.com tcp
US 8.8.8.8:53 nate.com udp
KR 120.50.131.112:587 nate.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
RU 185.215.113.67:40960 tcp
NL 142.93.237.125:587 mx.generic-isp.com tcp
US 8.8.8.8:53 smtp.shaw.ca udp
US 8.8.8.8:53 bigpond.net.au udp
US 8.8.8.8:53 mail.atlanticbb.net udp
US 8.8.8.8:53 mx.armstrong.syn-alias.com udp
US 8.8.8.8:53 secure.sardafarms.com udp
US 8.8.8.8:53 out.pb.com udp
US 8.8.8.8:53 out.comercialmadero.com udp
AU 139.134.5.153:587 bigpond.net.au tcp
US 193.122.187.19:587 mx.armstrong.syn-alias.com tcp
US 8.8.8.8:53 mail.optimum.net udp
US 8.8.8.8:53 smtp.cs.com udp
US 8.8.8.8:53 smtp.tatelecom.com udp
US 8.8.8.8:53 mx1.lcn.com udp
US 8.8.8.8:53 softbank.ne.jp udp
US 8.8.8.8:53 out.infolink.com.br udp
US 8.8.8.8:53 modulonet.fr udp
GB 85.233.160.28:465 mx1.lcn.com tcp
IE 87.248.97.31:587 smtp.cs.com tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 38.111.141.32:587 mail.atlanticbb.net tcp
CA 64.59.128.135:587 smtp.shaw.ca tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 posteo.de udp
DE 185.67.36.168:587 posteo.de tcp
US 8.8.8.8:53 smtp.netzero.net udp
US 8.8.8.8:53 securesmtp.cfgward.co.uk udp
US 8.8.8.8:53 securesmtp.666blueowlrd666.herobo.com udp
US 104.19.239.228:587 earthlink.net tcp
US 153.92.0.100:587 securesmtp.666blueowlrd666.herobo.com tcp
US 8.8.8.8:53 178.61.28.50.in-addr.arpa udp
US 8.8.8.8:53 31.97.248.87.in-addr.arpa udp
US 8.8.8.8:53 32.141.111.38.in-addr.arpa udp
US 8.8.8.8:53 168.36.67.185.in-addr.arpa udp
US 8.8.8.8:53 secure.animalia-asistencia.com udp
US 8.8.8.8:53 noos.fr udp
US 104.19.239.228:587 earthlink.net tcp
KR 120.50.131.112:587 nate.com tcp
US 64.136.44.44:587 smtp.netzero.net tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 out.compaq.net udp
US 64.136.44.44:587 smtp.netzero.net tcp
US 8.8.8.8:53 smtp.sdsl.no udp
US 8.8.8.8:53 out.dnbanks.com udp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 direktschall.de udp
US 66.22.19.195:465 out.dnbanks.com tcp
NL 142.250.153.26:465 aspmx3.googlemail.com tcp
FI 95.217.175.239:465 direktschall.de tcp
DK 194.19.134.66:587 smtp.sdsl.no tcp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 mail.aliceadsl.de udp
US 8.8.8.8:53 smtp.ziggo.nl udp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 secure.sunnyhillcycles.com udp
US 8.8.8.8:53 out.assenberg.demon.nl udp
US 8.8.8.8:53 mail.captiv8promos.com udp
US 8.8.8.8:53 smtp.cogeco.ca udp
US 166.62.108.43:465 mail.captiv8promos.com tcp
US 8.8.8.8:53 mail.ntendas.com.br udp
US 8.8.8.8:53 neostrada.pl udp
PL 80.48.169.1:587 neostrada.pl tcp
US 8.8.8.8:53 smtp.me.com udp
US 193.122.131.100:587 smtp.cogeco.ca tcp
US 17.57.155.28:587 smtp.me.com tcp
KR 120.50.131.112:587 nate.com tcp
US 8.8.8.8:53 cdtm.de udp
DE 129.187.254.228:587 cdtm.de tcp
US 8.8.8.8:53 comcast.com udp
US 8.8.8.8:53 out.empal.com udp
US 96.99.227.0:587 comcast.com tcp
US 8.8.8.8:53 out.terrarosacrm.com udp
US 8.8.8.8:53 myself.com udp
US 8.8.8.8:53 135.128.59.64.in-addr.arpa udp
US 8.8.8.8:53 44.44.136.64.in-addr.arpa udp
US 8.8.8.8:53 3.6.116.84.in-addr.arpa udp
US 8.8.8.8:53 28.155.57.17.in-addr.arpa udp
US 8.8.8.8:53 mail.rock-n-rollen.de udp
FR 141.94.139.121:587 mail2.mail-vert.fr tcp
US 8.8.8.8:53 supersonic.co.id udp
US 8.8.8.8:53 secure.ncr.yearup.org udp
US 8.8.8.8:53 optusnet.com.au udp
AU 211.29.132.105:587 optusnet.com.au tcp
US 8.8.8.8:53 eyou.com udp
US 8.8.8.8:53 smtp.infinito.it udp
IT 194.185.246.171:587 smtp.infinito.it tcp
US 8.8.8.8:53 i.softbank.jp udp
US 8.8.8.8:53 mx2-eu1.ppe-hosted.com udp
NL 91.209.104.156:587 mx2-eu1.ppe-hosted.com tcp
KR 120.50.131.112:587 nate.com tcp
CN 117.50.20.113:587 eyou.com tcp
US 8.8.8.8:53 blackplanet.com udp
US 44.217.161.11:587 blackplanet.com tcp
US 8.8.8.8:53 out.veriz.net udp
ID 103.163.138.8:587 supersonic.co.id tcp
US 8.8.8.8:53 mx01.ionos.de udp
US 8.8.8.8:53 datastefan.se udp
US 8.8.8.8:53 secure.landerandlander.com udp
DE 217.72.192.67:465 mx01.ionos.de tcp
US 63.249.144.1:465 secure.landerandlander.com tcp
US 103.224.212.210:587 out.veriz.net tcp
US 8.8.8.8:53 securesmtp.sanchez-bayton.com udp
US 65.20.63.172:587 mail.optimum.net tcp
US 44.217.161.11:587 blackplanet.com tcp
US 8.8.8.8:53 lve.de udp
DE 136.243.32.102:587 lve.de tcp
US 8.8.8.8:53 eforward4.registrar-servers.com udp
US 162.255.118.52:587 eforward4.registrar-servers.com tcp
US 8.8.8.8:53 mx.mannbdinfo.org udp
US 104.131.176.42:587 mx.mannbdinfo.org tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 securesmtp.kkag.com udp
NL 142.250.27.27:587 alt1.aspmx.l.google.com tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 tmkweb.com udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 171.246.185.194.in-addr.arpa udp
US 8.8.8.8:53 156.104.209.91.in-addr.arpa udp
US 8.8.8.8:53 8.138.163.103.in-addr.arpa udp
US 8.8.8.8:53 42.176.131.104.in-addr.arpa udp
US 12.36.80.154:587 tmkweb.com tcp
US 8.8.8.8:53 pchome.com.tw udp
US 34.110.144.106:587 pchome.com.tw tcp
NL 20.23.151.207:587 epost.de tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
NL 20.23.151.207:587 epost.de tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 smtp.machineacoudre.fr udp
US 8.8.8.8:53 excite.com udp
GB 151.101.190.114:587 excite.com tcp
US 8.8.8.8:53 out.sanfordburnham.org udp
US 8.8.8.8:53 secure.fixtpoint.com udp
KR 120.50.131.112:587 nate.com tcp
US 65.20.63.172:587 mail.optimum.net tcp
IT 79.143.126.202:587 mta2.spin.it tcp
US 8.8.8.8:53 securesmtp.golkos.com udp
US 193.122.187.19:587 mx.armstrong.syn-alias.com tcp
US 8.8.8.8:53 secure.iris.sipp.ac.cn udp
US 8.8.8.8:53 smtp.consultrans.es udp
US 8.8.8.8:53 smtp.raj.freeuk.com udp
ES 212.81.153.195:587 smtp.consultrans.es tcp
US 8.8.8.8:53 smtp.bbox.fr udp
GB 195.8.66.22:587 smtp.raj.freeuk.com tcp
FR 194.158.122.55:587 smtp.bbox.fr tcp
US 8.8.8.8:53 mx2.hc167-46.ca.iphmx.com udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
CA 216.71.132.28:587 mx2.hc167-46.ca.iphmx.com tcp
NL 142.250.153.27:465 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 securesmtp.bowdies.com udp
NL 142.250.153.26:465 aspmx3.googlemail.com tcp
US 8.8.8.8:53 mail.shults.com udp
NL 142.250.153.27:465 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 195.153.81.212.in-addr.arpa udp
US 8.8.8.8:53 mx10.se.isp-net.nl udp
NL 154.59.104.23:587 mx10.se.isp-net.nl tcp
US 74.208.236.143:465 mail.shults.com tcp
US 8.8.8.8:53 homesforourtroops.org udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 out.tigpe.com udp
US 8.8.8.8:53 wendoverhills.org udp
US 15.197.225.128:465 homesforourtroops.org tcp
NL 20.23.151.207:587 epost.de tcp
US 34.205.242.146:587 out.tigpe.com tcp
US 52.27.100.214:587 wendoverhills.org tcp
US 8.8.8.8:53 mx4c76.carrierzone.com udp
US 69.49.115.76:587 mx4c76.carrierzone.com tcp
US 8.8.8.8:53 mail.dgcvhs.com udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 securesmtp.ubt-uni.net udp
US 8.8.8.8:53 securesmtp.cnywebs.com udp
US 8.8.8.8:53 secure.sayclub.com udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 mail.midstatesd.net udp
US 8.8.8.8:53 mail.ubn.ca udp
US 17.57.155.28:587 smtp.me.com tcp
US 129.159.110.135:587 mail.midstatesd.net tcp
FI 142.250.150.27:587 alt4.aspmx.l.google.com tcp
FR 142.250.201.179:465 mail.ubn.ca tcp
DK 194.19.134.66:587 smtp.sdsl.no tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 mail.ardmore.net udp
US 8.8.8.8:53 mail.ldssystems.com udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 out.aakcay.com udp
US 191.96.51.8:465 mail.ldssystems.com tcp
US 8.8.8.8:53 23.104.59.154.in-addr.arpa udp
US 8.8.8.8:53 vtcantibes.fr udp
US 65.20.63.172:587 mail.optimum.net tcp
BG 194.153.145.104:587 abv.bg tcp
FR 109.234.161.117:587 vtcantibes.fr tcp
US 8.8.8.8:53 out.boswellinsurance.com udp
US 65.20.63.172:587 mail.optimum.net tcp
GB 185.151.30.194:465 out.boswellinsurance.com tcp
US 129.159.110.135:587 mail.ardmore.net tcp
US 8.8.8.8:53 smtp.cuchd.int2qo udp
DK 194.19.134.66:587 smtp.sdsl.no tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 secure.redgeeks.com udp
US 8.8.8.8:53 telia.com udp
SE 81.236.63.162:587 telia.com tcp
US 8.8.8.8:53 mail.conservatoriopalermo.it udp
US 8.8.8.8:53 smtp.freemail.hu udp
US 17.57.155.28:587 smtp.me.com tcp
US 8.8.8.8:53 mxa-001ffb01.gslb.pphosted.com udp
DE 128.140.51.166:587 mail.conservatoriopalermo.it tcp
HU 84.2.43.67:587 smtp.freemail.hu tcp
US 8.8.8.8:53 brtph7ee.bnr.ca udp
US 8.8.8.8:53 mail.nexgo.de udp
DE 2.207.150.234:587 mail.nexgo.de tcp
US 8.8.8.8:53 sky.com udp
GB 90.216.128.5:587 sky.com tcp
US 67.231.152.40:587 mxa-001ffb01.gslb.pphosted.com tcp
US 8.8.8.8:53 smtp.kramoo.de udp
US 8.8.8.8:53 brtph8a0.bnr.ca udp
US 8.8.8.8:53 devonald.net udp
US 65.20.63.172:587 mail.optimum.net tcp
US 162.215.226.3:465 devonald.net tcp
US 8.8.8.8:53 fgjgh.de udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mail.alosa.com udp
US 8.8.8.8:53 secure.simpatico.ca udp
US 8.8.8.8:53 secure.biggersandcallaham.com udp
US 8.8.8.8:53 117.161.234.109.in-addr.arpa udp
US 8.8.8.8:53 67.43.2.84.in-addr.arpa udp
US 8.8.8.8:53 234.150.207.2.in-addr.arpa udp
US 8.8.8.8:53 securesmtp.womperso.com udp
US 8.8.8.8:53 out.trek920.com udp
US 8.8.8.8:53 walserlaw.com udp
US 8.8.8.8:53 springer-info.de udp
US 35.172.94.1:587 walserlaw.com tcp
US 8.8.8.8:53 securesmtp.northpennfire.com udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 smtp.sifree.it udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 securesmtp.mefasamedica.com udp
US 8.8.8.8:53 mail163120.maychuemail.com udp
US 104.19.239.228:587 earthlink.net tcp
IT 217.27.113.8:25 smtp.sifree.it tcp
US 8.8.8.8:53 smtp.inwind.it udp
US 8.8.8.8:53 out.asoundtech.com udp
BG 194.153.145.104:587 abv.bg tcp
IT 213.209.1.147:587 smtp.inwind.it tcp
US 8.8.8.8:53 noos.fr udp
US 8.8.8.8:53 temporary-mail.net udp
US 172.67.142.207:587 temporary-mail.net tcp
US 8.8.8.8:53 smtp.ziggo.nl udp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 secure.mywave.it udp
US 8.8.8.8:53 ourcontinuum-com.mail.protection.outlook.com udp
US 52.101.9.12:587 ourcontinuum-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 out.susandepue.com udp
US 8.8.8.8:53 secure.amerisourcebergen.com udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 mail.samlori.com udp
US 8.8.8.8:53 147.1.209.213.in-addr.arpa udp
PK 209.150.154.62:587 out.susandepue.com tcp
US 8.8.8.8:53 smtp.mv-hallstadt.de udp
US 209.182.166.23:25 secure.amerisourcebergen.com tcp
FR 142.250.201.179:465 mail.samlori.com tcp
US 8.8.8.8:53 secure.cegi.net udp
KR 120.50.131.112:587 nate.com tcp
US 8.8.8.8:53 out.samseth.com udp
US 8.8.8.8:53 secure.venetor.com udp
US 207.148.248.143:587 secure.cegi.net tcp
CA 64.59.128.135:587 smtp.shaw.ca tcp
US 13.248.169.48:587 secure.venetor.com tcp
VN 103.77.163.120:587 mail163120.maychuemail.com tcp
US 8.8.8.8:53 upcmail.nl udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 out.pop.com.br udp
US 8.8.8.8:53 smtp.kabelbw.de udp
US 8.8.8.8:53 smtp.netcologne.de udp
US 65.20.63.172:587 mail.optimum.net tcp
DE 2.207.150.234:587 smtp.kabelbw.de tcp
US 8.8.8.8:53 psg.com udp
DE 213.168.87.11:587 smtp.netcologne.de tcp
US 147.28.0.62:587 psg.com tcp
KR 120.50.131.112:587 nate.com tcp
US 8.8.8.8:53 out.aehughes.com udp
DK 194.19.134.66:587 smtp.sdsl.no tcp
NL 142.250.153.26:465 aspmx3.googlemail.com tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 servisindo.com udp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 fife.gov.uk udp
DE 142.251.9.27:587 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 out.eresmas.com udp
GB 103.15.170.72:587 fife.gov.uk tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 11.87.168.213.in-addr.arpa udp
US 8.8.8.8:53 120.163.77.103.in-addr.arpa udp
US 8.8.8.8:53 out.baycountyfl.gov udp
ES 62.37.237.60:587 out.eresmas.com tcp
HU 84.2.43.67:587 smtp.freemail.hu tcp
US 8.8.8.8:53 smtp.aquavalor.fr udp
US 8.8.8.8:53 linshiyouxiang.net udp
FR 193.70.18.144:587 smtp.aquavalor.fr tcp
US 104.21.31.170:587 linshiyouxiang.net tcp
US 8.8.8.8:53 secure.bizbre.com udp
US 8.8.8.8:53 smtp.bww.com udp
US 8.8.8.8:53 securesmtp.gavingaile.com udp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
DK 194.19.134.66:587 smtp.sdsl.no tcp
US 8.8.8.8:53 thefindmachine.de udp
ID 111.221.42.98:587 servisindo.com tcp
CA 216.40.42.5:587 smtp.bww.com tcp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
US 65.20.63.172:587 mail.optimum.net tcp
NL 142.250.153.26:587 aspmx3.googlemail.com tcp
BG 194.153.145.104:587 abv.bg tcp
DE 142.251.9.27:465 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 cibelescajamadrid.es udp
US 8.8.8.8:53 secure.surewest.uk udp
US 8.8.8.8:53 out.uuss.com udp
US 8.8.8.8:53 smtp.elderowen.com.au udp
US 8.8.8.8:53 lapinha.com.br udp
US 8.8.8.8:53 securesmtp.clinic-all.info udp
US 199.59.243.226:465 out.uuss.com tcp
US 8.8.8.8:53 mx.fkksol.com udp
US 8.8.8.8:53 smtp.allied-health.net.au udp
US 104.131.176.42:587 mx.fkksol.com tcp
US 8.8.8.8:53 smtp.ig.com.br udp
FR 92.204.80.0:587 smtp.allied-health.net.au tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 out.tinokou.com udp
US 8.8.8.8:53 smtp.ecalton.com udp
NL 20.23.151.207:587 epost.de tcp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 144.18.70.193.in-addr.arpa udp
US 8.8.8.8:53 5.42.40.216.in-addr.arpa udp
US 8.8.8.8:53 98.42.221.111.in-addr.arpa udp
US 8.8.8.8:53 mail.dejazzd.com udp
US 8.8.8.8:53 mail.interfree.it udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 129.213.213.65:587 mail.dejazzd.com tcp
IT 80.91.55.62:587 mail.interfree.it tcp
BG 194.153.145.104:587 abv.bg tcp
BR 177.153.54.225:465 lapinha.com.br tcp
US 172.67.142.207:587 temporary-mail.net tcp
NL 20.23.151.207:587 epost.de tcp
NL 20.23.151.207:587 epost.de tcp
DE 142.251.9.27:587 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 clear.net.nz udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 17.57.155.28:587 smtp.me.com tcp
US 8.8.8.8:53 orbnge.fr udp
US 8.8.8.8:53 mx.gcdetectivefree.com udp
US 8.8.8.8:53 i.softbank.jp udp
US 104.131.176.42:587 mx.gcdetectivefree.com tcp
US 72.52.178.23:587 kefgames.net tcp
US 8.8.8.8:53 wittech.in.net udp
NZ 203.97.37.85:587 clear.net.nz tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 secure.ville-montbrison.fr udp
US 8.8.8.8:53 smtp.renogroupltd.co.uk udp
CN 117.50.20.113:587 eyou.com tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 mail.ase.com udp
US 23.253.146.205:587 mail.ase.com tcp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 203.132.0.168.in-addr.arpa udp
US 8.8.8.8:53 62.55.91.80.in-addr.arpa udp
US 8.8.8.8:53 secure.ifidfkhyuiklssddgnnmnvf.com udp
US 8.8.8.8:53 securesmtp.0757info.com udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 securesmtp.dorman.com udp
NL 20.23.151.207:587 epost.de tcp
NL 142.250.153.26:587 aspmx3.googlemail.com tcp
US 8.8.8.8:53 smtp.741.com udp
US 104.21.31.170:587 linshiyouxiang.net tcp
US 8.8.8.8:53 adinet.com.uy udp
US 8.8.8.8:53 smtp.travelmarketeers.de udp
NL 142.250.153.26:587 aspmx3.googlemail.com tcp
US 8.8.8.8:53 securesmtp.esteelauder.com udp
US 8.8.8.8:53 mail.relayfloorsystemsltd.com udp
US 8.8.8.8:53 mx2.forwardemail.net udp
GB 79.170.44.34:587 mail.relayfloorsystemsltd.com tcp
US 104.248.224.170:465 mx2.forwardemail.net tcp
US 8.8.8.8:53 mail.megahits.com udp
UY 200.40.31.18:587 adinet.com.uy tcp
US 104.232.32.174:587 mail.megahits.com tcp
US 8.8.8.8:53 isaiah.com udp
US 15.197.225.128:587 isaiah.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 smtp.cobs.de udp
US 65.20.63.172:587 mail.optimum.net tcp
US 8.8.8.8:53 usaor.net udp
US 8.8.8.8:53 secure.gaertnerei-woerner.com udp
US 8.8.8.8:53 garciallc.com udp
US 8.8.8.8:53 smtp.zerounocomputer.com udp

Files

memory/2904-0-0x0000000000700000-0x0000000000BB5000-memory.dmp

memory/2904-1-0x0000000077764000-0x0000000077766000-memory.dmp

memory/2904-2-0x0000000000701000-0x000000000072F000-memory.dmp

memory/2904-3-0x0000000000700000-0x0000000000BB5000-memory.dmp

memory/2904-4-0x0000000000700000-0x0000000000BB5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 b11892f158cfe77a2f4664eafd2711c7
SHA1 2217fb495537169ffaf2ba12c21ad56ed55080a8
SHA256 3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb
SHA512 3b8d8dc0c3cbb5541c5148b49bf136a4743f88e0433cee750cd4e4a61e92c2d7606a3cdf200b3c9703c01e5a2b1d58eecfcd28cca92870794e613845653ea729

memory/2904-18-0x0000000000700000-0x0000000000BB5000-memory.dmp

memory/3584-17-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/3584-20-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/3584-19-0x0000000000841000-0x000000000086F000-memory.dmp

memory/3584-21-0x0000000000840000-0x0000000000CF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

MD5 d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA1 36a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512 ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

memory/2020-46-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/2016-54-0x00000000007E0000-0x00000000007E1000-memory.dmp

memory/4964-55-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2020-57-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/4964-58-0x0000000004F10000-0x00000000054B4000-memory.dmp

memory/4964-59-0x0000000004960000-0x00000000049F2000-memory.dmp

memory/4964-60-0x0000000004A10000-0x0000000004A1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpAE80.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/4964-77-0x0000000005740000-0x00000000057B6000-memory.dmp

memory/464-79-0x0000000000400000-0x0000000000643000-memory.dmp

memory/464-78-0x0000000000400000-0x0000000000643000-memory.dmp

memory/4964-80-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

memory/4964-83-0x00000000066F0000-0x0000000006D08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 04e90b2cf273efb3f6895cfcef1e59ba
SHA1 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

memory/4964-84-0x0000000008080000-0x000000000818A000-memory.dmp

memory/4964-93-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

memory/4964-96-0x0000000008010000-0x000000000804C000-memory.dmp

memory/4964-101-0x0000000008190000-0x00000000081DC000-memory.dmp

memory/464-103-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2268-142-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2268-146-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2268-145-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2268-143-0x0000000000400000-0x0000000000536000-memory.dmp

C:\Users\Admin\AppData\Roaming\W51FnED9e6.exe

MD5 74e358f24a40f37c8ffd7fa40d98683a
SHA1 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA256 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA512 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

C:\Users\Admin\AppData\Roaming\tfqT0t4ico.exe

MD5 2c2be38fb507206d36dddb3d03096518
SHA1 a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA256 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512 e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

memory/2268-169-0x0000000000400000-0x0000000000536000-memory.dmp

memory/3440-176-0x0000000000CB0000-0x0000000000D36000-memory.dmp

memory/4280-177-0x00000000002E0000-0x0000000000364000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

MD5 b7c754e3d138f019a46ec5c4dc9a83af
SHA1 29cf2d28dbfbdcb6094d891e2106f09a4d47094e
SHA256 1b33f65ee722201b03af18bb98cfa8e8497bb8c25bfcc036803b8858b6ccf40d
SHA512 cb0f6a648a3e1271c285132aa59aba55de88648473fabb97c9b648ae2fa5f0e57bd433e05e49ffb59d7260ab4d7d303601ed739f608fb96088a85b5d4ccaad45

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

MD5 a9a37926c6d3ab63e00b12760fae1e73
SHA1 944d6044e111bbad742d06852c3ed2945dc9e051
SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

memory/2556-237-0x0000000000D30000-0x0000000000D82000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721909339-1374969515-2476821579-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2221bd08-0ad1-421d-9910-53a6f41d16ee

MD5 8386a23a046f66e1f60ce5314ef4bc7e
SHA1 e66071961977c46e9bcf179a757b4cb9235f0a27
SHA256 05840c846540eb16a0ec33074072728c5c1bd3875e8852959d8b841ec548ffcf
SHA512 75cb5b5a0608f0911007e432fe029e1fc5d880400e0f70b3e016f07aae0ae57c58a2c545ce69bd04c867654972e1e98912b0a1082aa5a5a5d1d9e30cb9a350ad

memory/3584-255-0x0000000000840000-0x0000000000CF5000-memory.dmp

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 ab30deac68245a4d09b87986d0e75616
SHA1 6aadf248529c355d1e775e1c0cb325ebd6c81bf5
SHA256 ee2ef794b2865f926d0c4c0c3f71092665500eb240801d254c6a36d2a4ae0b11
SHA512 45a0205244e5e3058facc2112af72d3cc75d94400deaa7e86c25a92d1e34223a5217f1ffc6329683b493eec685a20334b760334cb424c40b4820381d32e1803b

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 d9195c07c32e1bfd4e645a2d798ac635
SHA1 6ed935aa7caca3b0a4ee09049567da38c41dae14
SHA256 9e8f6715bd382f3f3a9289cb57a1431f7f7eb6f83073715a72474b617267a42a
SHA512 1b4e74f3af6fcb6a98c44485933e1fdd344c372cfb81d9f7de1112caec810ea5f3c699b4120ac2f3632ecc251164b157c0f0061939160091eef3a4ddd8c35c6d

memory/4964-260-0x0000000006340000-0x00000000063A6000-memory.dmp

memory/4964-263-0x0000000006500000-0x0000000006550000-memory.dmp

memory/1528-265-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4964-266-0x00000000087B0000-0x0000000008972000-memory.dmp

memory/4964-267-0x0000000008EB0000-0x00000000093DC000-memory.dmp

memory/3584-269-0x0000000000840000-0x0000000000CF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

MD5 faf1270013c6935ae2edaf8e2c2b2c08
SHA1 d9a44759cd449608589b8f127619d422ccb40afa
SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098

memory/3584-278-0x0000000000840000-0x0000000000CF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI38802\ucrtbase.dll

MD5 cd7a487bb5ca20005a81402eee883569
SHA1 f427aaf18b53311a671e60b94bd897a904699d19
SHA256 f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7
SHA512 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417

C:\Users\Admin\AppData\Local\Temp\_MEI38802\python310.dll

MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

C:\Users\Admin\AppData\Local\Temp\_MEI38802\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\_MEI38802\base_library.zip

MD5 72d4e288992c783409b299f4fc842d39
SHA1 ba2ed3d465949d6a5e583286161cff01eca39258
SHA256 ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085
SHA512 bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_ctypes.pyd

MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

C:\Users\Admin\AppData\Local\Temp\_MEI38802\python3.DLL

MD5 07bd9f1e651ad2409fd0b7d706be6071
SHA1 dfeb2221527474a681d6d8b16a5c378847c59d33
SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512 def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

C:\Users\Admin\AppData\Local\Temp\_MEI38802\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_socket.pyd

MD5 e137df498c120d6ac64ea1281bcab600
SHA1 b515e09868e9023d43991a05c113b2b662183cfe
SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512 cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

C:\Users\Admin\AppData\Local\Temp\_MEI38802\select.pyd

MD5 adc412384b7e1254d11e62e451def8e9
SHA1 04e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA256 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512 f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_pytransform.dll

MD5 4a9d54d85df402bb7fea9f1c278ff5a4
SHA1 414ce62f8fef39a08cd9214296e3a4985ea2f5e6
SHA256 c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9
SHA512 8b5176cdeedc092282cd7963cf15e2348143de43d0bf0551e37071c2b5319c3aa214a2e2232d095f8f3e7c64e3475b3455fa593413ca8f1d04e8b133d4ef91ba

memory/748-388-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-414-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-412-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-410-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-408-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-406-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-404-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-402-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-400-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-398-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-396-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-394-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-392-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-390-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-386-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-384-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-382-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-380-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-378-0x000001D452380000-0x000001D452381000-memory.dmp

memory/748-377-0x000001D452370000-0x000001D452371000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI38802\libcrypto-1_1.dll

MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_lzma.pyd

MD5 b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA1 4efe3f21be36095673d949cceac928e11522b29c
SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512 e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

C:\Users\Admin\AppData\Local\Temp\_MEI38802\unicodedata.pyd

MD5 102bbbb1f33ce7c007aac08fe0a1a97e
SHA1 9a8601bea3e7d4c2fa6394611611cda4fc76e219
SHA256 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
SHA512 a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_bz2.pyd

MD5 a4b636201605067b676cc43784ae5570
SHA1 e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA512 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_queue.pyd

MD5 23f4becf6a1df36aee468bb0949ac2bc
SHA1 a0e027d79a281981f97343f2d0e7322b9fe9b441
SHA256 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
SHA512 3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_hashlib.pyd

MD5 49ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1 dcfbee380e7d6c88128a807f381a831b6a752f10
SHA256 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512 cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_brotli.cp310-win_amd64.pyd

MD5 ee3d454883556a68920caaedefbc1f83
SHA1 45b4d62a6e7db022e52c6159eef17e9d58bec858
SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
SHA512 e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

C:\Users\Admin\AppData\Local\Temp\_MEI38802\libssl-1_1.dll

MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

C:\Users\Admin\AppData\Local\Temp\_MEI38802\_ssl.pyd

MD5 35f66ad429cd636bcad858238c596828
SHA1 ad4534a266f77a9cdce7b97818531ce20364cb65
SHA256 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA512 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

memory/3584-1658-0x0000000000840000-0x0000000000CF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

MD5 95606667ac40795394f910864b1f8cc4
SHA1 e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512 fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

MD5 4e0235942a9cde99ee2ee0ee1a736e4f
SHA1 d084d94df2502e68ee0443b335dd621cd45e2790
SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512 cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f

memory/1724-1725-0x0000000000740000-0x0000000000792000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

MD5 3c18dac89d980c0102252ad706634952
SHA1 4f92c678de5867fcec46dff19560390a7affbc7c
SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
SHA512 fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d

memory/768-1778-0x0000000000E30000-0x0000000001073000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

MD5 aedfb26f18fdd54279e8d1b82b84559a
SHA1 161a427ef200282daf092543b3eda9b8cd689514
SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
SHA512 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

memory/5228-1809-0x0000000000370000-0x00000000003C2000-memory.dmp

C:\ProgramData\BKFIJJEG

MD5 72d6dfd319e75b8e90d5137cfbac3c28
SHA1 5c62b77847077178635448e6b74c092d54e6fe3d
SHA256 cd6c4d558dc6ed8c01de08580dd2736cf0882edaaa34480e4f153545dcb5abd7
SHA512 fb48dc3a329a1f3929beb128f2617b486c4a1ef2b9a368eaf16a2defc1495aa949c29fa8c3b4ff446dcf5a074a83a69b3bc7664537f9eafef4b6858b7526189b

C:\ProgramData\GIIJEBAE

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/6064-1913-0x0000000000400000-0x000000000041E000-memory.dmp

C:\ProgramData\JJJEGCGDGHCBFHIDHDAA

MD5 4c98e6ba5682d1a1b902dd12e0c4f67d
SHA1 9f64ab5097086c14de226bece9d83d2857142ec7
SHA256 2ec572a9ae7c901fb4c79393b04e03ef823cc09c1208eb30f02dbd22cb3456be
SHA512 8373535e66597f2c809d16f808bed9960ad081d39b82f5bffae662adb5ab3d847dd6370533057a4c12d807edc6527d934e7efa3cb40922d5ef05cfed984a41bc

memory/768-1945-0x0000000000E30000-0x0000000001073000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp81DF.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmp8220.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp8236.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp8277.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/7108-2122-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/7108-2124-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/1244-2163-0x0000000000840000-0x0000000000CF5000-memory.dmp

memory/1244-2165-0x0000000000840000-0x0000000000CF5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 06:14

Reported

2024-07-31 06:17

Platform

win11-20240730-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2156 created 3308 N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe C:\Windows\Explorer.EXE
PID 2156 created 3308 N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe C:\Windows\Explorer.EXE
PID 2156 created 3308 N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe C:\Windows\Explorer.EXE

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\ProgramData\xgukxe\dvhfq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
N/A N/A C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" C:\Windows\system32\msiexec.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A
N/A N/A C:\Windows\System32\powercfg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\da.msg C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\tkMessageBox.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_nonzero.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Grand_Turk C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\license.terms C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sha.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\req\req_file.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp1258.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\history.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\curtainmode\CurtainMode64.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\chunk.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\clean.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\SimpleDialog.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Sydney C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\mclist.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Bratislava C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixer_base.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\adapter.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Havana C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Calcutta C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\constants.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Kentucky\Louisville C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Hobart C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\plusarm.gif C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\asynchat.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbobj.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\difflib.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_7.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TK.csc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\dom\minicompat.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\big5.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp855.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mutex.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\iso8859-4.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Boise C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Chungking C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\plus.xpm C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\install_data.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\robotparser.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\compat.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\README.txt C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Eirunepe C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Resolute C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Zulu C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\nturl2path.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\locators.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\lint.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\_markerlib\markers.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\pyassem.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\dde1.3\pkgIndex.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_13.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\SHList.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\pkgIndex.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\configDialog.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\symbol.enc C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Riga C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\images\tcllogo.gif C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\STList2.tcl C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp424.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_future.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mimify.py C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Bahia C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-1 C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemTemp\~DFEA0CD7CDB2E8735C.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF83A624C1B4FD2DC6.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59c20e.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF3742C043F3C5C77B.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC916.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICEF4.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE107.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC55A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC5B8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC84A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF892FED7BD082833B.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e59c20e.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi C:\Windows\syswow64\MsiExec.exe N/A
File opened for modification C:\Windows\Installer\MSIEC14.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICFCF.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59c210.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC926.tmp C:\Windows\system32\msiexec.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\xgukxe\dvhfq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dropperrr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adada.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pureee.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A
N/A N/A C:\Windows\System32\conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 544 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 544 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 544 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1604 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 1604 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 1604 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
PID 2920 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1604 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 1604 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 1604 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
PID 1604 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1604 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1604 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4704 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2824 wrote to memory of 4420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe
PID 2824 wrote to memory of 4420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe
PID 2824 wrote to memory of 4420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe
PID 2824 wrote to memory of 4600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe
PID 2824 wrote to memory of 4600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe
PID 2824 wrote to memory of 4600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe
PID 1604 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 1604 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 1604 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
PID 1604 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 1604 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 1604 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
PID 1604 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 1604 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2772 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 2772 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
PID 1176 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Windows\system32\cmd.exe
PID 1176 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe C:\Windows\system32\cmd.exe
PID 1604 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 1604 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 4004 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
PID 4004 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe

"C:\Users\Admin\AppData\Local\Temp\3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe

"C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe"

C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe

"C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1600 -ip 1600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 388

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\_MEI40042\Blsvr.exe

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

clamer.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\ProgramData\xgukxe\dvhfq.exe

C:\ProgramData\xgukxe\dvhfq.exe

C:\Users\Admin\AppData\Local\Temp\pureee.exe

"C:\Users\Admin\AppData\Local\Temp\pureee.exe"

C:\Users\Admin\AppData\Local\Temp\adada.exe

"C:\Users\Admin\AppData\Local\Temp\adada.exe"

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe

"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D4B4373E8403C3A8C4034D0BDFB0D4FE

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C040C526567E2DDBA70672938BBDAB2D E Global\MSI0000

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
DE 20.52.165.210:39030 tcp
RU 85.28.47.70:80 85.28.47.70 tcp
VN 103.28.36.182:443 coe.com.vn tcp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 109.120.137.52:80 109.120.137.52 tcp
RU 185.215.113.67:40960 tcp
US 34.117.59.81:443 ipinfo.io tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 185.215.113.9:9137 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.225.219.163:80 91.225.219.163 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
NL 91.92.240.111:1334 91.92.240.111 tcp
FR 141.94.96.144:3333 pool.supportxmr.com tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 172.67.75.172:443 api.ip.sb tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:80 91.92.240.111 tcp
RU 185.215.113.67:40960 tcp
CH 185.196.9.187:80 185.196.9.187 tcp
CA 51.222.21.20:4782 tcp
RU 185.215.113.67:40960 tcp
NL 91.92.240.111:39001 tcp
DE 195.201.57.90:443 ipwho.is tcp
NL 91.92.240.111:80 91.92.240.111 tcp
US 172.67.177.136:443 vaniloin.fun tcp
RU 185.215.113.67:40960 tcp
GB 161.35.34.195:3333 rx.unmineable.com tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
NL 185.43.220.45:4000 claywyaeropumps.com tcp
NL 185.43.220.45:4476 claywyaeropumps.com tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
RU 185.215.113.67:40960 tcp
US 8.8.8.8:53 ymobile.ne.jp udp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 mxb-00695501.gslb.pphosted.com udp
US 8.8.8.8:53 1visionmedia.com udp
US 129.213.213.65:587 mail.dejazzd.com tcp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 out.hammarstrand.se udp
US 8.8.8.8:53 mail.optonline.net udp
DE 143.55.146.131:465 mxb-00695501.gslb.pphosted.com tcp
CA 199.85.66.2:587 sympatico.ca tcp
US 65.20.63.172:587 mail.optonline.net tcp
DK 77.111.240.148:465 mail.zenon-artshop.nl tcp
DK 94.231.103.92:587 out.hammarstrand.se tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
DE 129.187.254.228:587 cdtm.de tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
KR 120.50.131.112:587 nate.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 65.20.63.172:587 mail.optonline.net tcp
BR 200.234.204.130:587 mx.jk.locaweb.com.br tcp
US 193.122.131.100:587 smtp.cogeco.ca tcp
CN 117.50.20.113:587 eyou.com tcp
NL 142.250.153.27:465 aspmx3.googlemail.com tcp
US 150.136.132.149:587 mx3.fuse.net tcp
US 104.18.208.148:587 earthlink.net tcp
CA 199.85.66.2:587 sympatico.ca tcp
US 44.213.8.1:587 secure.ucityschools.org tcp
NL 20.23.151.207:587 epost.de tcp
GB 185.75.120.74:465 txrxcomms.co.uk tcp
US 65.20.63.172:587 mail.optonline.net tcp
CZ 109.123.210.26:587 tiscali.cz tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
US 65.20.63.172:587 mail.optonline.net tcp
CZ 109.123.210.26:587 tiscali.cz tcp
DE 172.104.233.109:465 smtp.ycit-he.org tcp
US 104.18.208.148:587 earthlink.net tcp
FI 142.250.150.26:587 alt4.aspmx.l.google.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
UZ 185.239.152.11:587 gs.uz tcp
US 172.67.178.176:587 linshiyouxiang.net tcp
US 17.57.155.28:587 smtp.me.com tcp
DE 185.53.178.54:587 secure.charlestonwv.net tcp
US 45.76.11.40:587 mail.gis.net tcp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 28.155.57.17.in-addr.arpa udp
US 65.20.63.172:587 mail.optonline.net tcp
US 104.21.33.80:587 temporary-mail.net tcp
BG 193.201.172.98:587 mail.bg tcp
NL 20.23.151.207:587 epost.de tcp
FR 87.98.160.167:587 mx2.mail.ovh.net tcp
NL 20.23.151.207:587 epost.de tcp
US 104.26.3.122:587 synergyreef.com tcp
US 66.133.129.50:587 smtp.frontier.com tcp
US 76.223.54.146:587 goti.net tcp
US 8.8.8.8:53 secure.d118.org udp
CA 140.238.133.27:587 smtp.mymts.net tcp
NL 40.114.138.145:465 poolmx.dsmail.es tcp
US 66.81.203.134:587 secure.xpredict.com tcp
US 192.124.249.18:587 proton.net.au tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 52.101.9.11:25 chemours-com.mail.protection.outlook.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
CA 216.40.42.4:465 mx.netidentity.com.cust.hostedemail.com tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 54.224.128.196:465 securesmtp.lucero-unciano.com tcp
US 24.116.124.161:587 cableone.net tcp
PL 91.211.221.102:587 pro-cultura.pl tcp
US 103.224.212.216:587 gamil.co tcp
US 104.21.23.39:587 ledbyteu.com tcp
IE 172.253.116.27:465 aspmx.l.google.com tcp
US 66.133.129.50:587 smtp.frontier.com tcp
CA 142.66.6.116:587 uleth.ca tcp
US 74.220.199.6:587 fitwithbrit.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
DK 46.30.213.138:465 out.iampelle.com tcp
US 198.90.23.13:587 lagoscentral.com tcp
FR 194.158.122.55:587 smtp.bbox.fr tcp
US 13.248.158.7:587 yaho.de tcp
BG 194.153.145.104:587 abv.bg tcp
RU 185.215.113.67:40960 tcp
NL 142.250.153.27:465 aspmx3.googlemail.com tcp
AU 52.64.186.0:587 smtp.westnet.com.au tcp
US 17.57.155.28:587 smtp.me.com tcp
FI 142.250.150.26:587 alt4.aspmx.l.google.com tcp
IT 185.201.65.231:587 mucciga.it tcp
US 65.20.63.172:587 mail.optonline.net tcp
DE 138.201.138.240:587 masumi88.inwebmail.fun tcp
IE 52.101.68.3:465 ifmi-com-sa.mail.protection.outlook.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 66.133.129.50:587 smtp.frontier.com tcp
US 193.122.131.100:587 smtp.cogeco.ca tcp
US 162.255.118.13:465 smx4.web-hosting.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
FR 217.70.184.38:465 contact-avenue.com tcp
US 45.56.79.23:587 out.consultant.com tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
DE 217.160.0.220:587 pep4teens.de tcp
US 65.20.63.172:587 mail.optonline.net tcp
SE 91.201.60.108:587 navet.com tcp
DK 185.138.56.213:587 mail.hot.ee tcp
US 97.77.197.3:25 mail2.txwinet.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
SE 81.236.63.162:587 telia.com tcp
SG 13.250.88.201:587 smtp.singnet.com.sg tcp
RU 185.215.113.67:40960 tcp
CA 199.85.66.2:587 sympatico.ca tcp
MT 80.93.157.24:587 maltanet.net tcp
US 68.232.141.28:25 mx1.xerox.iphmx.com tcp
US 172.67.68.237:587 5x2.de tcp
DE 142.251.9.26:465 alt3.aspmx.l.google.com tcp
NL 194.213.127.95:465 secure.wijkcentrumdeburgerij.nl tcp
US 66.133.129.50:587 smtp.frontier.com tcp
IE 52.101.68.29:25 banca-mps-it.mail.protection.outlook.com tcp
US 104.18.3.81:587 mail.i.ua tcp
GB 213.175.196.22:587 ukaquanaut.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
FR 92.204.80.1:587 smtp.oldfl.com tcp
US 209.202.254.90:587 lycos.co.kr tcp
KR 121.78.233.138:465 accretechkorea.com tcp
FR 194.158.122.55:587 smtp.bbox.fr tcp
GB 212.159.8.234:587 smtp.globalnet.co.uk tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
DE 217.160.0.126:465 tanzschulebogner.de tcp
JP 59.157.128.15:587 smtp.mx7.ttcn.ne.jp tcp
CZ 109.123.210.26:587 tiscali.cz tcp
BG 194.153.145.104:587 abv.bg tcp
US 199.60.103.92:587 contractor.de tcp
BG 194.153.145.104:587 abv.bg tcp
DE 217.160.0.241:587 colegiolamerced.org tcp
US 17.57.155.28:587 smtp.me.com tcp
BG 194.153.145.104:587 abv.bg tcp
IE 172.253.116.27:465 aspmx.l.google.com tcp
DE 18.184.254.238:443 mdmsupport.cmdm.comodo.com tcp
US 146.190.223.124:587 aero4.unstablemail.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
US 65.20.63.172:587 mail.optonline.net tcp
CN 106.11.249.99:587 aliyun.com tcp
DE 2.207.150.234:587 smtp.vodafone.de tcp
CZ 185.85.164.171:587 elektroline.cz tcp
US 172.65.182.103:465 mx2.hostinger.es tcp
NL 213.132.197.171:465 mailfilter.domainorderdns.nl tcp
US 103.224.212.215:465 secure.warriorlike.us tcp
US 52.101.10.16:587 gfimn-com.mail.protection.outlook.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mail.beat.com.tn udp
US 65.20.63.172:587 mail.optonline.net tcp
US 35.71.162.15:587 docomo.ne.jp tcp
US 8.8.8.8:53 smtpin.rzone.de udp
DE 217.160.233.72:587 wemo-barbing.de tcp
US 129.159.110.135:587 smtp.netsync.net tcp
DE 81.169.145.97:465 smtpin.rzone.de tcp
US 209.202.254.90:587 lycos.co.kr tcp
FR 193.70.18.144:587 mail.beat.com.tn tcp
US 13.248.158.7:587 yaho.de tcp
US 34.110.144.106:587 pchome.com.tw tcp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
US 52.101.42.18:587 zestkit-com.mail.protection.outlook.com tcp
US 4.71.15.106:465 mail.kmazlaw.com tcp
US 8.8.8.8:53 secure.gexik.com udp
US 8.8.8.8:53 securesmtp.moomooclubrooms.com udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
N/A 127.0.0.1:20777 tcp
N/A 127.0.0.1:20777 tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 mxlb.ispgateway.de udp
US 8.8.8.8:53 mx.websitebooty.com udp
US 52.71.57.184:587 secure.gexik.com tcp
NL 142.250.27.27:587 alt1.aspmx.l.google.com tcp
US 167.172.23.243:587 mx.websitebooty.com tcp
DE 80.67.18.126:587 mxlb.ispgateway.de tcp
US 17.57.155.28:587 smtp.me.com tcp
BG 194.153.145.104:587 abv.bg tcp
IE 172.253.116.27:465 aspmx.l.google.com tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
CA 140.238.133.27:587 smtp.mymts.net tcp
US 8.8.8.8:53 students.ocps.net udp
US 3.19.116.195:465 securesmtp.spyring.com tcp
US 168.184.213.180:587 students.ocps.net tcp
CA 64.68.200.44:587 kugkkt.de tcp
US 34.95.107.114:587 mxb.eu.mailgun.org tcp
GB 213.219.55.206:25 hbosplc.com tcp
DE 217.160.233.72:587 wemo-barbing.de tcp
IE 54.247.79.251:587 mail.avneyderech.com tcp
US 8.8.8.8:53 out.hanmir.com udp
US 8.8.8.8:53 ol2106.mail.protection.outlook.com udp
US 8.8.8.8:53 netflix.com udp
IE 54.73.148.110:587 netflix.com tcp
US 205.220.173.20:587 mxa-00221b01.gslb.pphosted.com tcp
NL 52.101.73.4:587 ol2106.mail.protection.outlook.com tcp
US 67.195.228.75:587 mx-biz.mail.am0.yahoodns.net tcp
DE 128.176.6.221:587 uni-muenster.de tcp
FR 141.94.139.121:587 mail2.mail-vert.fr tcp
US 8.8.8.8:53 sky.com udp
GB 90.216.128.5:587 sky.com tcp
DE 78.47.254.46:587 lol.de tcp
JP 160.13.60.174:587 sonet-common-mx-v4.xspmail.jp tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 45.60.247.143:587 sercomtel.com.br tcp
NL 84.116.6.3:587 smtp.ziggo.nl tcp
NL 142.93.237.125:587 mx.generic-isp.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
DE 49.13.50.5:465 out.federleicht-ag.de tcp
IE 172.253.116.27:587 aspmx.l.google.com tcp
KR 120.50.131.112:587 nate.com tcp
US 8.8.8.8:53 capcuteditorcompany.itsm-us1.comodo.com udp
IT 62.149.128.157:465 mail.apotemastudio.it tcp
US 34.236.22.242:443 capcuteditorcompany.itsm-us1.comodo.com tcp
US 8.8.8.8:53 125.237.93.142.in-addr.arpa udp
US 8.8.8.8:53 143.247.60.45.in-addr.arpa udp
US 8.8.8.8:53 securesmtp.guensel.de udp
US 8.8.8.8:53 smtp.mts.net udp
US 65.20.63.172:587 mail.optonline.net tcp
US 65.20.63.172:587 mail.optonline.net tcp
NL 40.74.34.62:465 securesmtp.guensel.de tcp
US 65.20.63.172:587 mail.optonline.net tcp
CA 204.101.250.8:25 smtp.mts.net tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
BG 194.153.145.104:587 abv.bg tcp
CN 117.50.20.113:587 eyou.com tcp
BG 194.153.145.104:587 abv.bg tcp
US 65.20.63.172:587 mail.optonline.net tcp
AU 110.232.143.33:587 tlcaustralia.com tcp
US 192.169.178.221:587 warwick.net tcp
JP 175.135.252.193:587 ksf.biglobe.ne.jp tcp
US 34.111.121.216:465 mx30.antispam.mailspamprotection.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 65.20.63.172:587 mail.optonline.net tcp
FR 85.69.170.254:587 crfps.com tcp
US 52.101.9.11:465 stevefrostlaw-com.mail.eo.outlook.com tcp
NL 142.250.153.27:465 aspmx3.googlemail.com tcp
BG 194.153.145.104:587 abv.bg tcp
CA 199.85.66.2:587 sympatico.ca tcp
US 8.8.8.8:53 193.252.135.175.in-addr.arpa udp
NL 142.93.237.125:587 mx.generic-isp.com tcp
US 8.8.8.8:53 smtp.email.it udp
DK 185.138.56.194:587 smtp.email.it tcp
DE 81.169.145.64:587 joithe.de tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
SG 192.250.235.33:587 mail.shadowshopper.com.au tcp
RU 185.215.113.67:40960 tcp
US 208.91.197.27:465 dawson-int.com tcp
CA 40.85.218.2:587 rogers.com tcp
NL 20.23.151.207:587 epost.de tcp
US 17.57.155.28:587 smtp.me.com tcp
IE 172.253.116.27:587 aspmx.l.google.com tcp
IE 172.253.116.27:465 aspmx.l.google.com tcp
US 204.11.56.48:587 mail.truthfinderlogin.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 52.24.89.24:587 amgen.com tcp
US 65.20.63.172:587 mail.optonline.net tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 204.128.192.15:587 tcp
BG 194.153.145.104:587 tcp
N/A 23.218.57.29:587 tcp
N/A 62.149.128.201:587 tcp
US 65.20.63.172:587 tcp

Files

memory/544-0-0x0000000000780000-0x0000000000C35000-memory.dmp

memory/544-1-0x0000000077656000-0x0000000077658000-memory.dmp

memory/544-2-0x0000000000781000-0x00000000007AF000-memory.dmp

memory/544-3-0x0000000000780000-0x0000000000C35000-memory.dmp

memory/544-5-0x0000000000780000-0x0000000000C35000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 b11892f158cfe77a2f4664eafd2711c7
SHA1 2217fb495537169ffaf2ba12c21ad56ed55080a8
SHA256 3616fe0360348c5b65156607bdbca306588fd145a081d9e396f3ad3b03fcc0cb
SHA512 3b8d8dc0c3cbb5541c5148b49bf136a4743f88e0433cee750cd4e4a61e92c2d7606a3cdf200b3c9703c01e5a2b1d58eecfcd28cca92870794e613845653ea729

memory/1604-16-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/544-18-0x0000000000780000-0x0000000000C35000-memory.dmp

memory/1604-19-0x00000000009B1000-0x00000000009DF000-memory.dmp

memory/1604-20-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/1604-21-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/1604-22-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

MD5 d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA1 36a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512 ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620

memory/224-39-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/744-40-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2920-41-0x0000000000D30000-0x0000000000D31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe

MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

memory/744-54-0x0000000005580000-0x0000000005B26000-memory.dmp

memory/744-56-0x0000000005070000-0x0000000005102000-memory.dmp

memory/224-61-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/744-59-0x0000000005200000-0x000000000520A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpC851.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/744-76-0x0000000005CB0000-0x0000000005D26000-memory.dmp

memory/744-77-0x0000000006340000-0x000000000635E000-memory.dmp

memory/744-80-0x0000000006CD0000-0x00000000072E8000-memory.dmp

memory/744-81-0x0000000008490000-0x000000000859A000-memory.dmp

memory/744-82-0x0000000006C00000-0x0000000006C12000-memory.dmp

memory/744-83-0x0000000006C60000-0x0000000006C9C000-memory.dmp

memory/744-84-0x00000000085A0000-0x00000000085EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 04e90b2cf273efb3f6895cfcef1e59ba
SHA1 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

memory/3676-99-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3676-100-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2824-105-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2824-109-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2824-108-0x0000000000400000-0x0000000000536000-memory.dmp

memory/2824-106-0x0000000000400000-0x0000000000536000-memory.dmp

memory/3676-110-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Roaming\UUuRpCcHXI.exe

MD5 74e358f24a40f37c8ffd7fa40d98683a
SHA1 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA256 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA512 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

C:\Users\Admin\AppData\Roaming\bi1yZiJrRd.exe

MD5 2c2be38fb507206d36dddb3d03096518
SHA1 a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA256 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512 e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

memory/2824-156-0x0000000000400000-0x0000000000536000-memory.dmp

memory/4600-166-0x0000000000E50000-0x0000000000ED4000-memory.dmp

memory/4420-167-0x00000000000C0000-0x0000000000146000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe

MD5 b7c754e3d138f019a46ec5c4dc9a83af
SHA1 29cf2d28dbfbdcb6094d891e2106f09a4d47094e
SHA256 1b33f65ee722201b03af18bb98cfa8e8497bb8c25bfcc036803b8858b6ccf40d
SHA512 cb0f6a648a3e1271c285132aa59aba55de88648473fabb97c9b648ae2fa5f0e57bd433e05e49ffb59d7260ab4d7d303601ed739f608fb96088a85b5d4ccaad45

C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe

MD5 a9a37926c6d3ab63e00b12760fae1e73
SHA1 944d6044e111bbad742d06852c3ed2945dc9e051
SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97

memory/2680-209-0x0000000000A30000-0x0000000000A82000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-118640398-3063844760-4281400433-1000\76b53b3ec448f7ccdda2063b15d2bfc3_0d57e5d2-8528-4ceb-bd0a-9fa7c2fa0116

MD5 0a7c8d1d35d3122a68ebbadae763d5df
SHA1 f7b901e2062a1af3180c97c64bed8c179c795836
SHA256 6be72bd19ac54e519f5e586b9f32d4992196258040a692bde1a40f75f863bb4b
SHA512 737a69c68785e19dba39f2295fbf3879917e7a9e5e12556f4aaa2fab0d05face0a40aa650d66cdb84fae2ee633b1065d6f020f46e02615b4b5d8d0ce06df7781

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 5fefcf2ff8bc11b14202cba8b3ff9039
SHA1 9e94d2b6415c9e306fd8676301c92a9918e4d720
SHA256 3662d12a287a4663cadd17df65679c5c667784d50b9e42b114d63186e36857fb
SHA512 540b5ec4fb04f0400202e5c76d1582b1265dc450c1d86da04f03f7024801c9b4a1e2d40f8d3375c4a6b715019b4d2fb55ee4665575dee3c34730bed9152b80e2

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 27f1dbae80f8a308072bc43c0efa6293
SHA1 68e7ecb193da97f2c7b647090557f099914dc608
SHA256 57b79df9fbfbc414d830b1f92b07dba28c04f8769cedf8a94f7c7d9ca7325460
SHA512 75e526b8afa362e87dd5b18915902c09f0c100ee0f243e9ae2d879341321d837aa5e228fe38e1c089266bd7121d2899103533f5bd55ceb50914faa1eb1b07c6b

memory/744-232-0x0000000006730000-0x0000000006796000-memory.dmp

memory/744-239-0x0000000009B10000-0x0000000009B60000-memory.dmp

memory/1600-240-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1604-241-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/1604-242-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/744-264-0x0000000009570000-0x0000000009732000-memory.dmp

memory/744-265-0x000000000A190000-0x000000000A6BC000-memory.dmp

memory/1604-267-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe

MD5 faf1270013c6935ae2edaf8e2c2b2c08
SHA1 d9a44759cd449608589b8f127619d422ccb40afa
SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098

C:\Users\Admin\AppData\Local\Temp\_MEI27722\ucrtbase.dll

MD5 cd7a487bb5ca20005a81402eee883569
SHA1 f427aaf18b53311a671e60b94bd897a904699d19
SHA256 f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7
SHA512 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python310.dll

MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

C:\Users\Admin\AppData\Local\Temp\_MEI27722\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_ctypes.pyd

MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

C:\Users\Admin\AppData\Local\Temp\_MEI27722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python3.dll

MD5 07bd9f1e651ad2409fd0b7d706be6071
SHA1 dfeb2221527474a681d6d8b16a5c378847c59d33
SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512 def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

C:\Users\Admin\AppData\Local\Temp\_MEI27722\base_library.zip

MD5 72d4e288992c783409b299f4fc842d39
SHA1 ba2ed3d465949d6a5e583286161cff01eca39258
SHA256 ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085
SHA512 bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_socket.pyd

MD5 e137df498c120d6ac64ea1281bcab600
SHA1 b515e09868e9023d43991a05c113b2b662183cfe
SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512 cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

C:\Users\Admin\AppData\Local\Temp\_MEI27722\select.pyd

MD5 adc412384b7e1254d11e62e451def8e9
SHA1 04e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA256 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512 f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_pytransform.dll

MD5 4a9d54d85df402bb7fea9f1c278ff5a4
SHA1 414ce62f8fef39a08cd9214296e3a4985ea2f5e6
SHA256 c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9
SHA512 8b5176cdeedc092282cd7963cf15e2348143de43d0bf0551e37071c2b5319c3aa214a2e2232d095f8f3e7c64e3475b3455fa593413ca8f1d04e8b133d4ef91ba

memory/1176-411-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-409-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-407-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-405-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-403-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-401-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-399-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-397-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-395-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-393-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-391-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-389-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-387-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-385-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-383-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-381-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-379-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-377-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-375-0x0000021DF7C20000-0x0000021DF7C21000-memory.dmp

memory/1176-374-0x0000021DF7C10000-0x0000021DF7C11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_ssl.pyd

MD5 35f66ad429cd636bcad858238c596828
SHA1 ad4534a266f77a9cdce7b97818531ce20364cb65
SHA256 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA512 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_hashlib.pyd

MD5 49ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1 dcfbee380e7d6c88128a807f381a831b6a752f10
SHA256 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512 cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_brotli.cp310-win_amd64.pyd

MD5 ee3d454883556a68920caaedefbc1f83
SHA1 45b4d62a6e7db022e52c6159eef17e9d58bec858
SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
SHA512 e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

C:\Users\Admin\AppData\Local\Temp\_MEI27722\libcrypto-1_1.dll

MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

C:\Users\Admin\AppData\Local\Temp\_MEI27722\libssl-1_1.dll

MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_queue.pyd

MD5 23f4becf6a1df36aee468bb0949ac2bc
SHA1 a0e027d79a281981f97343f2d0e7322b9fe9b441
SHA256 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
SHA512 3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_bz2.pyd

MD5 a4b636201605067b676cc43784ae5570
SHA1 e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA512 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_lzma.pyd

MD5 b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA1 4efe3f21be36095673d949cceac928e11522b29c
SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512 e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

C:\Users\Admin\AppData\Local\Temp\_MEI27722\unicodedata.pyd

MD5 102bbbb1f33ce7c007aac08fe0a1a97e
SHA1 9a8601bea3e7d4c2fa6394611611cda4fc76e219
SHA256 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
SHA512 a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

memory/1604-1656-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/1604-1657-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe

MD5 95606667ac40795394f910864b1f8cc4
SHA1 e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512 fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142

C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe

MD5 4e0235942a9cde99ee2ee0ee1a736e4f
SHA1 d084d94df2502e68ee0443b335dd621cd45e2790
SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512 cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f

memory/2672-1722-0x0000000000A80000-0x0000000000AD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe

MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

MD5 3c18dac89d980c0102252ad706634952
SHA1 4f92c678de5867fcec46dff19560390a7affbc7c
SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
SHA512 fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d

memory/5400-1776-0x0000000000DD0000-0x0000000001013000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe

MD5 aedfb26f18fdd54279e8d1b82b84559a
SHA1 161a427ef200282daf092543b3eda9b8cd689514
SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
SHA512 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

memory/5632-1807-0x0000000000650000-0x00000000006A2000-memory.dmp

C:\ProgramData\IECGHJKK

MD5 da3607e9fd16f805f8c5a0a1584eaf94
SHA1 c5f43cc703af450ea878988b0d791e2d427377b6
SHA256 308c9fcbcc86c4b876937e1d11ab95881912506269dcae7bc893ce3871bdf420
SHA512 9d3d672f82538b7f3311325c0b240b249dd328531b519ee7809e166719cfbe4bae65f6669a237e67067e566c594ed6859d458ff9f010f632279f1e3fdadc6730

C:\ProgramData\JEHDHIEG

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe

MD5 4c3049f8e220c2264692cb192b741a30
SHA1 46c735f574daaa3e6605ef4c54c8189f5722ff2a
SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
SHA512 b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe

MD5 58ccb4c9da26dbf5584194406ee2f4b3
SHA1 ae91798532b747f410099ef7d0e36bffeca6361c
SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
SHA512 dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

memory/5072-1911-0x0000000000400000-0x000000000041E000-memory.dmp

C:\ProgramData\HDHCGHDHIDHCBGCBGCAE

MD5 dfe637c813541e372d21b794b15e1cf0
SHA1 e51cba83da2cff9e5f0cb9d61a043055ad2ef71d
SHA256 31039a68a5ad252b1e78ba2b09bf534bbe0610f9cbce85fa6a5f628a4553d688
SHA512 13dd3cc38ccf3efdcf8cdb358cfe2d1fb419ea87933fd004c140625f01f53692eca59ac1a3229305da8260a3181a424e3650999e185a487418f622c5d552f720

memory/5400-1945-0x0000000000DD0000-0x0000000001013000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA5A1.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\tmpA5D9.tmp

MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

C:\Users\Admin\AppData\Local\Temp\tmpA5D3.tmp

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\tmpA60B.tmp

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/5640-2123-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/5640-2125-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pureee.exe

MD5 0006ad7b9f2a9b304e5b3790f6f18807
SHA1 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9
SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
SHA512 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

memory/2256-2138-0x000001E857CE0000-0x000001E857D8A000-memory.dmp

memory/2256-2139-0x000001E872320000-0x000001E87242A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adada.exe

MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

memory/5712-5736-0x0000000000E10000-0x0000000001134000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

MD5 35e7f1f850ca524d0eaa6522a4451834
SHA1 e98db252a62c84fd87416d2ec347de46ec053ebd
SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
SHA512 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

memory/2256-6167-0x000001E872240000-0x000001E872296000-memory.dmp

memory/2256-6168-0x000001E8722A0000-0x000001E8722EC000-memory.dmp

memory/3700-6174-0x000000001D550000-0x000000001D5A0000-memory.dmp

memory/3700-6175-0x000000001D660000-0x000000001D712000-memory.dmp

memory/3700-6176-0x000000001D5A0000-0x000000001D5B2000-memory.dmp

memory/3700-6177-0x000000001D600000-0x000000001D63C000-memory.dmp

memory/4692-6221-0x00000000009B0000-0x0000000000E65000-memory.dmp

memory/4692-6223-0x00000000009B0000-0x0000000000E65000-memory.dmp

C:\Windows\Installer\MSICEF4.tmp

MD5 82d54afa53f6733d6529e4495700cdd8
SHA1 b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA256 8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA512 22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

C:\Windows\Installer\MSICFCF.tmp

MD5 d53b2b818b8c6a2b2bae3a39e988af10
SHA1 ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA512 3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

MD5 a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1 957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA256 5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512 e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

C:\Config.Msi\e59c20f.rbs

MD5 1a0d6459439adc69d4cb9b1bab76f81d
SHA1 50612a0276a0328886cc0d1156cdad8565213496
SHA256 441744b9e079314f3eaa5e88286d84ad29c14a5a3f12bb479ea960bda4ebca55
SHA512 75393cc968390f3888f549b0004ab3c50257c3708712a0aeb651f3a17651fc3e4d0174a48bd0ec79500c2eb592ce3f38c9273fd3f307addaf1c58ca2deba56b7