Analysis
-
max time kernel
106s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 16:23
Static task
static1
Behavioral task
behavioral1
Sample
exploror.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
exploror.exe
Resource
win10v2004-20220414-en
General
-
Target
exploror.exe
-
Size
1.1MB
-
MD5
d6df53506b123f5717463d0355336979
-
SHA1
7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14
-
SHA256
70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694
-
SHA512
1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral1/memory/2040-65-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 4 IoCs
pid Process 2040 ._cache_exploror.exe 2000 Synaptics.exe 516 Peahrfb.exe 1308 Peahrfb.exe -
Loads dropped DLL 4 IoCs
pid Process 756 exploror.exe 756 exploror.exe 756 exploror.exe 756 exploror.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" exploror.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: ._cache_exploror.exe File opened (read-only) \??\K: ._cache_exploror.exe File opened (read-only) \??\U: ._cache_exploror.exe File opened (read-only) \??\W: ._cache_exploror.exe File opened (read-only) \??\X: ._cache_exploror.exe File opened (read-only) \??\Z: ._cache_exploror.exe File opened (read-only) \??\F: ._cache_exploror.exe File opened (read-only) \??\M: ._cache_exploror.exe File opened (read-only) \??\V: ._cache_exploror.exe File opened (read-only) \??\P: ._cache_exploror.exe File opened (read-only) \??\Q: ._cache_exploror.exe File opened (read-only) \??\S: ._cache_exploror.exe File opened (read-only) \??\Y: ._cache_exploror.exe File opened (read-only) \??\I: ._cache_exploror.exe File opened (read-only) \??\J: ._cache_exploror.exe File opened (read-only) \??\L: ._cache_exploror.exe File opened (read-only) \??\N: ._cache_exploror.exe File opened (read-only) \??\O: ._cache_exploror.exe File opened (read-only) \??\R: ._cache_exploror.exe File opened (read-only) \??\T: ._cache_exploror.exe File opened (read-only) \??\B: ._cache_exploror.exe File opened (read-only) \??\E: ._cache_exploror.exe File opened (read-only) \??\G: ._cache_exploror.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Peahrfb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Peahrfb.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe ._cache_exploror.exe File opened for modification C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe ._cache_exploror.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ._cache_exploror.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ._cache_exploror.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecisionTime = 902f823b2e66d801 Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecisionTime = 902f823b2e66d801 Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecisionReason = "1" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecision = "0" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecisionTime = 905cee472e66d801 Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadNetworkName = "Network 3" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecisionReason = "1" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadNetworkName = "Network 3" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecisionReason = "1" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29} Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecision = "0" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\ca-54-da-38-6d-62 Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecisionTime = 902f823b2e66d801 Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecision = "0" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDecisionTime = 905cee472e66d801 Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecision = "0" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\WpadDecisionReason = "1" Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-54-da-38-6d-62\WpadDetectedUrl Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29} Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79CDD3F5-1EF6-4429-A7FA-510B0F5C5F29}\ca-54-da-38-6d-62 Peahrfb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2040 ._cache_exploror.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 756 wrote to memory of 2040 756 exploror.exe 27 PID 756 wrote to memory of 2040 756 exploror.exe 27 PID 756 wrote to memory of 2040 756 exploror.exe 27 PID 756 wrote to memory of 2040 756 exploror.exe 27 PID 756 wrote to memory of 2000 756 exploror.exe 28 PID 756 wrote to memory of 2000 756 exploror.exe 28 PID 756 wrote to memory of 2000 756 exploror.exe 28 PID 756 wrote to memory of 2000 756 exploror.exe 28 PID 516 wrote to memory of 1308 516 Peahrfb.exe 33 PID 516 wrote to memory of 1308 516 Peahrfb.exe 33 PID 516 wrote to memory of 1308 516 Peahrfb.exe 33 PID 516 wrote to memory of 1308 516 Peahrfb.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\exploror.exe"C:\Users\Admin\AppData\Local\Temp\exploror.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe"C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
PID:2000
-
-
C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1308
-
Network
-
Remote address:8.8.8.8:53Requestxred.mooo.comIN AResponse
-
Remote address:8.8.8.8:53Requestfreedns.afraid.orgIN AResponsefreedns.afraid.orgIN A69.42.215.252
-
GEThttp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978Synaptics.exeRemote address:69.42.215.252:80RequestGET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Thu, 12 May 2022 16:29:26 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
-
Remote address:8.8.8.8:53Requestdocs.google.comIN AResponsedocs.google.comIN A142.250.179.174
-
Remote address:142.250.179.174:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 12 May 2022 16:30:25 GMT
Strict-Transport-Security: max-age=31536000
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-CYML6XF0LBjCtCWAQrw9Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Server: ESF
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
-
Remote address:142.250.179.174:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 12 May 2022 16:30:25 GMT
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: script-src 'report-sample' 'nonce-w7n//As0/wpHrqsE1Q9zhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Opener-Policy: same-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Server: ESF
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
-
Remote address:142.250.179.174:443RequestGET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 12 May 2022 16:30:25 GMT
Strict-Transport-Security: max-age=31536000
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-JiS5RbkrB1fzLRJ0gOpVdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Server: ESF
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
-
152 B 80 B 3 2
-
69.42.215.252:80http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978httpSynaptics.exe706 B 415 B 12 4
HTTP Request
GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978HTTP Response
200 -
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 80 B 3 2
-
152 B 40 B 3 1
-
1.0kB 338 B 9 8
-
152 B 120 B 3 3
-
142.250.179.174:443https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtls, httpSynaptics.exe1.6kB 18.0kB 17 25
HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404HTTP Request
GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHTTP Response
404
-
59 B 118 B 1 1
DNS Request
xred.mooo.com
-
64 B 80 B 1 1
DNS Request
freedns.afraid.org
DNS Response
69.42.215.252
-
61 B 77 B 1 1
DNS Request
docs.google.com
DNS Response
142.250.179.174
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
754KB
MD5310a7ff41f6633132e6c2bc25e51e567
SHA15f687df8cc3185ed68d77d0e05502c2eb308c5c8
SHA256d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab
SHA512ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
754KB
MD5310a7ff41f6633132e6c2bc25e51e567
SHA15f687df8cc3185ed68d77d0e05502c2eb308c5c8
SHA256d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab
SHA512ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980
-
Filesize
754KB
MD5310a7ff41f6633132e6c2bc25e51e567
SHA15f687df8cc3185ed68d77d0e05502c2eb308c5c8
SHA256d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab
SHA512ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb
-
Filesize
400KB
MD5f82f50d6a61d3d73172fcbf3ff665e89
SHA12e5cde938a2822a13348e55f4ad0dfa75d545fee
SHA256afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd
SHA512f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb