Resubmissions

27/11/2024, 09:59 UTC

241127-l1hj5aynbt 10

22/06/2023, 05:40 UTC

230622-gcwdvsdh9z 10

Analysis

  • max time kernel
    103s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2023, 05:40 UTC

General

  • Target

    file.exe

  • Size

    448KB

  • MD5

    f5a4e48c469d899bf882475b36dff8d9

  • SHA1

    b1845ec95f2837038461a04dc266bcb48a052fcb

  • SHA256

    d850df618ed03fd518cb4c52bb09657a2eda865702a0498b965b0279ea73b362

  • SHA512

    8be14d34d360537a82532b8172d5ad4c257ac703f0ecbc021871d521723ff942101ba84c53ccbd3148808f2f7a3748bd478e7e1e89cb53e1d95a32907b81b003

  • SSDEEP

    6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snqv/cgu4VGn6OaM+ucj

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 15 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • XMRig Miner payload 9 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3172
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4308
      • C:\Windows\system32\certreq.exe
        "C:\Windows\system32\certreq.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • outlook_office_path
        • outlook_win_path
        PID:1572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3428
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3636
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:2704
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3292
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:4552
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:4180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vjciy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4148
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:764
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3284
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
            PID:1612
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
              PID:3128
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2728
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\System32\sc.exe
              sc stop UsoSvc
              3⤵
              • Launches sc.exe
              PID:4376
            • C:\Windows\System32\sc.exe
              sc stop WaaSMedicSvc
              3⤵
              • Launches sc.exe
              PID:4024
            • C:\Windows\System32\sc.exe
              sc stop wuauserv
              3⤵
              • Launches sc.exe
              PID:1440
            • C:\Windows\System32\sc.exe
              sc stop bits
              3⤵
              • Launches sc.exe
              PID:380
            • C:\Windows\System32\sc.exe
              sc stop dosvc
              3⤵
              • Launches sc.exe
              PID:700
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
            2⤵
              PID:2692
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Windows\System32\powercfg.exe
                powercfg /x -hibernate-timeout-ac 0
                3⤵
                  PID:2008
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -hibernate-timeout-dc 0
                  3⤵
                    PID:412
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -standby-timeout-ac 0
                    3⤵
                      PID:2856
                    • C:\Windows\System32\powercfg.exe
                      powercfg /x -standby-timeout-dc 0
                      3⤵
                        PID:4612
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zmjvgdgm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4684
                    • C:\Windows\System32\schtasks.exe
                      C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                      2⤵
                        PID:1272
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2476
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3800
                        • C:\Windows\System32\sc.exe
                          sc stop dosvc
                          3⤵
                          • Launches sc.exe
                          PID:2704
                        • C:\Windows\System32\sc.exe
                          sc stop bits
                          3⤵
                          • Launches sc.exe
                          PID:3636
                        • C:\Windows\System32\sc.exe
                          sc stop wuauserv
                          3⤵
                          • Launches sc.exe
                          PID:4132
                        • C:\Windows\System32\sc.exe
                          sc stop WaaSMedicSvc
                          3⤵
                          • Launches sc.exe
                          PID:4660
                        • C:\Windows\System32\sc.exe
                          sc stop UsoSvc
                          3⤵
                          • Launches sc.exe
                          PID:1484
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vjciy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                        2⤵
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3632
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3292
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-ac 0
                          3⤵
                            PID:3644
                          • C:\Windows\System32\powercfg.exe
                            powercfg /x -hibernate-timeout-dc 0
                            3⤵
                              PID:1632
                            • C:\Windows\System32\powercfg.exe
                              powercfg /x -standby-timeout-ac 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1612
                            • C:\Windows\System32\powercfg.exe
                              powercfg /x -standby-timeout-dc 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3128
                          • C:\Windows\System32\conhost.exe
                            C:\Windows\System32\conhost.exe
                            2⤵
                              PID:1464
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              2⤵
                                PID:1392
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                2⤵
                                  PID:3228
                              • C:\Users\Admin\AppData\Local\Microsoft\n~n8ze1l.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\n~n8ze1l.exe"
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3420
                              • C:\Users\Admin\AppData\Local\Microsoft\Tu[6gheX9k.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\Tu[6gheX9k.exe"
                                1⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in Program Files directory
                                • Suspicious use of WriteProcessMemory
                                PID:4192
                                • C:\Program Files\Google\Chrome\Application\BrowserUpdate.exe
                                  "C:\Program Files\Google\Chrome\Application\BrowserUpdate.exe" -l james5453545@protonmail.com
                                  2⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1968
                              • C:\Users\Admin\AppData\Local\Microsoft\q937-vn8.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\q937-vn8.exe"
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3220
                              • C:\Program Files\Google\Chrome\updater.exe
                                "C:\Program Files\Google\Chrome\updater.exe"
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2340

                              Network

                              • flag-us
                                DNS
                                18.11.98.141.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                18.11.98.141.in-addr.arpa
                                IN PTR
                                Response
                                18.11.98.141.in-addr.arpa
                                IN PTR
                                squeamishwoinstacom
                              • flag-us
                                DNS
                                62.13.109.52.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                62.13.109.52.in-addr.arpa
                                IN PTR
                                Response
                              • flag-us
                                DNS
                                api.peer2profit.global
                                BrowserUpdate.exe
                                Remote address:
                                8.8.8.8:53
                                Request
                                api.peer2profit.global
                                IN A
                                Response
                                api.peer2profit.global
                                IN A
                                104.26.9.6
                                api.peer2profit.global
                                IN A
                                172.67.69.54
                                api.peer2profit.global
                                IN A
                                104.26.8.6
                              • flag-us
                                DNS
                                6.9.26.104.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                6.9.26.104.in-addr.arpa
                                IN PTR
                                Response
                              • flag-us
                                DNS
                                46.72.251.87.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                46.72.251.87.in-addr.arpa
                                IN PTR
                                Response
                                46.72.251.87.in-addr.arpa
                                IN PTR
                                devops-zbrexamplecom
                              • flag-us
                                DNS
                                xmr.2miners.com
                                Remote address:
                                8.8.8.8:53
                                Request
                                xmr.2miners.com
                                IN A
                                Response
                                xmr.2miners.com
                                IN A
                                162.19.139.184
                              • flag-us
                                DNS
                                46.72.251.87.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                46.72.251.87.in-addr.arpa
                                IN PTR
                                Response
                                46.72.251.87.in-addr.arpa
                                IN PTR
                                devops-zbrexamplecom
                              • flag-us
                                DNS
                                184.139.19.162.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                184.139.19.162.in-addr.arpa
                                IN PTR
                                Response
                                184.139.19.162.in-addr.arpa
                                IN PTR
                                p062minerscom
                              • flag-us
                                DNS
                                fp.check.peer2profit.site
                                Remote address:
                                8.8.8.8:53
                                Request
                                fp.check.peer2profit.site
                                IN A
                                Response
                                fp.check.peer2profit.site
                                IN A
                                162.19.176.4
                              • flag-us
                                DNS
                                github.com
                                Remote address:
                                8.8.8.8:53
                                Request
                                github.com
                                IN A
                                Response
                                github.com
                                IN A
                                140.82.112.4
                              • flag-us
                                DNS
                                www.wikipedia.org
                                Remote address:
                                8.8.8.8:53
                                Request
                                www.wikipedia.org
                                IN A
                                Response
                                www.wikipedia.org
                                IN CNAME
                                dyna.wikimedia.org
                                dyna.wikimedia.org
                                IN A
                                208.80.154.224
                              • flag-us
                                DNS
                                twitter.com
                                Remote address:
                                8.8.8.8:53
                                Request
                                twitter.com
                                IN A
                                Response
                                twitter.com
                                IN A
                                104.244.42.129
                                twitter.com
                                IN A
                                104.244.42.1
                                twitter.com
                                IN A
                                104.244.42.193
                                twitter.com
                                IN A
                                104.244.42.65
                              • flag-us
                                DNS
                                en.wikipedia.org
                                Remote address:
                                8.8.8.8:53
                                Request
                                en.wikipedia.org
                                IN A
                                Response
                                en.wikipedia.org
                                IN CNAME
                                dyna.wikimedia.org
                                dyna.wikimedia.org
                                IN A
                                208.80.154.224
                              • flag-us
                                DNS
                                4.176.19.162.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                4.176.19.162.in-addr.arpa
                                IN PTR
                                Response
                                4.176.19.162.in-addr.arpa
                                IN PTR
                                ip4 ip-162-19-176eu
                              • flag-us
                                DNS
                                206.179.250.142.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                206.179.250.142.in-addr.arpa
                                IN PTR
                                Response
                                206.179.250.142.in-addr.arpa
                                IN PTR
                                ams15s42-in-f141e100net
                              • flag-us
                                DNS
                                196.168.217.172.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                196.168.217.172.in-addr.arpa
                                IN PTR
                                Response
                                196.168.217.172.in-addr.arpa
                                IN PTR
                                ams16s32-in-f41e100net
                              • flag-us
                                DNS
                                129.42.244.104.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                129.42.244.104.in-addr.arpa
                                IN PTR
                                Response
                              • flag-us
                                DNS
                                4.112.82.140.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                4.112.82.140.in-addr.arpa
                                IN PTR
                                Response
                                4.112.82.140.in-addr.arpa
                                IN PTR
                                lb-140-82-112-4-iadgithubcom
                              • flag-us
                                DNS
                                224.154.80.208.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                224.154.80.208.in-addr.arpa
                                IN PTR
                                Response
                                224.154.80.208.in-addr.arpa
                                IN PTR
                                text-lbeqiad wikimediaorg
                              • flag-us
                                DNS
                                api.blocklist.de
                                Remote address:
                                8.8.8.8:53
                                Request
                                api.blocklist.de
                                IN A
                                Response
                                api.blocklist.de
                                IN A
                                185.21.103.31
                              • flag-de
                                GET
                                http://api.blocklist.de/api.php?ip=154.61.71.13&start=1
                                Remote address:
                                185.21.103.31:80
                                Request
                                GET http://api.blocklist.de/api.php?ip=154.61.71.13&start=1 HTTP/1.1
                                Host: api.blocklist.de
                                User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
                                Accept-Encoding: gzip
                                Response
                                HTTP/1.1 200 OK
                                Server: nginx
                                Date: Thu, 22 Jun 2023 05:42:20 GMT
                                Content-Type: text/plain;charset=UTF-8
                                Content-Length: 46
                                Connection: keep-alive
                                Keep-Alive: timeout=20
                                Expires: Thu, 22 Jun 2023 05:27:20 GMT
                                Cache-Control: private, max-age=1687411640, pre-check=86400
                                Last-Modified: Thu, 22 Jun 2023 05:42:18 GMT
                                Vary: Accept-Encoding
                                Content-Encoding: gzip
                                X-Frame-Options: sameorigin
                                Cache-Control: public
                              • flag-us
                                DNS
                                31.103.21.185.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                31.103.21.185.in-addr.arpa
                                IN PTR
                                Response
                                31.103.21.185.in-addr.arpa
                                IN PTR
                                webserver3 blocklistde
                              • flag-us
                                DNS
                                otx.alienvault.com
                                Remote address:
                                8.8.8.8:53
                                Request
                                otx.alienvault.com
                                IN A
                                Response
                                otx.alienvault.com
                                IN A
                                108.156.60.62
                                otx.alienvault.com
                                IN A
                                108.156.60.87
                                otx.alienvault.com
                                IN A
                                108.156.60.81
                                otx.alienvault.com
                                IN A
                                108.156.60.60
                              • flag-us
                                DNS
                                www.threatcrowd.org
                                Remote address:
                                8.8.8.8:53
                                Request
                                www.threatcrowd.org
                                IN A
                                Response
                                www.threatcrowd.org
                                IN CNAME
                                prod-otxb-threatcrowd.otxb.io
                                prod-otxb-threatcrowd.otxb.io
                                IN CNAME
                                prod-ecsel-o1gfruenxfub-825410333.us-west-2.elb.amazonaws.com
                                prod-ecsel-o1gfruenxfub-825410333.us-west-2.elb.amazonaws.com
                                IN A
                                44.237.49.181
                              • flag-us
                                DNS
                                62.60.156.108.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                62.60.156.108.in-addr.arpa
                                IN PTR
                                Response
                                62.60.156.108.in-addr.arpa
                                IN PTR
                                server-108-156-60-62ams1r cloudfrontnet
                              • flag-us
                                DNS
                                181.49.237.44.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                181.49.237.44.in-addr.arpa
                                IN PTR
                                Response
                                181.49.237.44.in-addr.arpa
                                IN PTR
                                ec2-44-237-49-181 us-west-2compute amazonawscom
                              • flag-us
                                DNS
                                fp-4.check.peer2profit.site
                                Remote address:
                                8.8.8.8:53
                                Request
                                fp-4.check.peer2profit.site
                                IN A
                                Response
                                fp-4.check.peer2profit.site
                                IN A
                                51.79.216.136
                              • flag-us
                                DNS
                                ubuntu.com
                                Remote address:
                                8.8.8.8:53
                                Request
                                ubuntu.com
                                IN A
                                Response
                                ubuntu.com
                                IN A
                                185.125.190.20
                                ubuntu.com
                                IN A
                                185.125.190.21
                                ubuntu.com
                                IN A
                                185.125.190.29
                              • flag-us
                                DNS
                                one.one.one.one
                                Remote address:
                                8.8.8.8:53
                                Request
                                one.one.one.one
                                IN A
                                Response
                                one.one.one.one
                                IN A
                                1.0.0.1
                                one.one.one.one
                                IN A
                                1.1.1.1
                              • flag-us
                                DNS
                                twitch.tv
                                Remote address:
                                8.8.8.8:53
                                Request
                                twitch.tv
                                IN A
                                Response
                                twitch.tv
                                IN A
                                151.101.66.167
                                twitch.tv
                                IN A
                                151.101.2.167
                                twitch.tv
                                IN A
                                151.101.130.167
                                twitch.tv
                                IN A
                                151.101.194.167
                              • flag-us
                                DNS
                                www.twitch.tv
                                Remote address:
                                8.8.8.8:53
                                Request
                                www.twitch.tv
                                IN A
                                Response
                                www.twitch.tv
                                IN CNAME
                                twitch.map.fastly.net
                                twitch.map.fastly.net
                                IN A
                                199.232.150.167
                              • flag-us
                                DNS
                                136.216.79.51.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                136.216.79.51.in-addr.arpa
                                IN PTR
                                Response
                                136.216.79.51.in-addr.arpa
                                IN PTR
                                ip136 ip-51-79-216net
                              • flag-us
                                DNS
                                20.190.125.185.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                20.190.125.185.in-addr.arpa
                                IN PTR
                                Response
                                20.190.125.185.in-addr.arpa
                                IN PTR
                                website-content-cache-1ps5 canonicalcom
                              • flag-us
                                DNS
                                167.66.101.151.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                167.66.101.151.in-addr.arpa
                                IN PTR
                                Response
                              • flag-us
                                DNS
                                1.0.0.1.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                1.0.0.1.in-addr.arpa
                                IN PTR
                                Response
                                1.0.0.1.in-addr.arpa
                                IN PTR
                                oneoneoneone
                              • flag-us
                                DNS
                                167.150.232.199.in-addr.arpa
                                Remote address:
                                8.8.8.8:53
                                Request
                                167.150.232.199.in-addr.arpa
                                IN PTR
                                Response
                              • 141.98.11.18:5351
                                tls
                                file.exe
                                34.2kB
                                2.0MB
                                721
                                1433
                              • 52.168.117.170:443
                                322 B
                                7
                              • 141.98.11.18:5351
                                tls
                                certreq.exe
                                72.1kB
                                4.3kB
                                66
                                41
                              • 141.98.11.18:5351
                                tls
                                certreq.exe
                                2.2MB
                                123.3MB
                                46370
                                88152
                              • 96.16.110.41:443
                                322 B
                                7
                              • 209.197.3.8:80
                                322 B
                                7
                              • 209.197.3.8:80
                                322 B
                                7
                              • 104.26.9.6:443
                                api.peer2profit.global
                                tls
                                BrowserUpdate.exe
                                1.2kB
                                3.6kB
                                8
                                9
                              • 87.251.72.46:443
                                https
                                1.7kB
                                4.2kB
                                33
                                50
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.4kB
                                7.2kB
                                9
                                11
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 162.19.176.4:443
                                fp.check.peer2profit.site
                                tls
                                939 B
                                5.4kB
                                10
                                12
                              • 87.251.72.46:443
                                https
                                5.7kB
                                1.1kB
                                13
                                15
                              • 87.251.72.46:443
                                https
                                8.2kB
                                1.2kB
                                13
                                15
                              • 208.80.154.224:443
                                www.wikipedia.org
                                tls
                                1.2kB
                                7.7kB
                                13
                                12
                              • 140.82.112.4:443
                                github.com
                                tls
                                1.0kB
                                4.5kB
                                12
                                10
                              • 87.251.72.46:443
                                https
                                5.7kB
                                1.0kB
                                11
                                13
                              • 104.244.42.129:443
                                twitter.com
                                tls
                                1.1kB
                                3.7kB
                                12
                                10
                              • 87.251.72.46:443
                                https
                                3.9kB
                                1.0kB
                                10
                                12
                              • 87.251.72.46:443
                                https
                                4.8kB
                                1.0kB
                                11
                                12
                              • 87.251.72.46:443
                                https
                                7.9kB
                                1.2kB
                                13
                                15
                              • 208.80.154.224:443
                                en.wikipedia.org
                                tls
                                1.2kB
                                7.7kB
                                12
                                12
                              • 87.251.72.46:443
                                https
                                8.0kB
                                1.2kB
                                13
                                15
                              • 162.19.176.4:443
                                fp.check.peer2profit.site
                                tls
                                978 B
                                5.4kB
                                11
                                12
                              • 87.251.72.46:443
                                https
                                5.8kB
                                1.1kB
                                14
                                16
                              • 185.21.103.31:80
                                http://api.blocklist.de/api.php?ip=154.61.71.13&start=1
                                http
                                481 B
                                643 B
                                6
                                4

                                HTTP Request

                                GET http://api.blocklist.de/api.php?ip=154.61.71.13&start=1

                                HTTP Response

                                200
                              • 87.251.72.46:443
                                https
                                993 B
                                256 B
                                7
                                6
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 108.156.60.62:443
                                otx.alienvault.com
                                tls
                                1.2kB
                                9.7kB
                                13
                                15
                              • 87.251.72.46:443
                                https
                                9.9kB
                                1.3kB
                                15
                                17
                              • 44.237.49.181:443
                                www.threatcrowd.org
                                tls
                                774 B
                                5.9kB
                                11
                                12
                              • 87.251.72.46:443
                                https
                                6.1kB
                                770 B
                                11
                                12
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 51.79.216.136:443
                                fp-4.check.peer2profit.site
                                tls
                                1.0kB
                                5.2kB
                                10
                                10
                              • 87.251.72.46:443
                                https
                                5.6kB
                                1.1kB
                                14
                                14
                              • 185.125.190.20:443
                                ubuntu.com
                                tls
                                1.1kB
                                6.6kB
                                13
                                12
                              • 208.80.154.224:443
                                www.wikipedia.org
                                tls
                                1.2kB
                                7.7kB
                                14
                                12
                              • 87.251.72.46:443
                                https
                                6.8kB
                                1.1kB
                                13
                                15
                              • 151.101.66.167:443
                                twitch.tv
                                tls
                                981 B
                                5.7kB
                                10
                                11
                              • 87.251.72.46:443
                                https
                                5.9kB
                                1.0kB
                                12
                                12
                              • 1.0.0.1:443
                                one.one.one.one
                                tls
                                1.0kB
                                6.0kB
                                11
                                9
                              • 87.251.72.46:443
                                https
                                6.3kB
                                1.1kB
                                12
                                14
                              • 87.251.72.46:443
                                https
                                8.2kB
                                1.2kB
                                13
                                15
                              • 199.232.150.167:443
                                www.twitch.tv
                                tls
                                1.1kB
                                6.2kB
                                11
                                13
                              • 87.251.72.46:443
                                https
                                6.0kB
                                1.2kB
                                12
                                14
                              • 87.251.72.46:443
                                https
                                7.9kB
                                1.2kB
                                13
                                15
                              • 208.80.154.224:443
                                en.wikipedia.org
                                tls
                                1.2kB
                                7.7kB
                                13
                                12
                              • 87.251.72.46:443
                                https
                                8.0kB
                                1.3kB
                                14
                                16
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 162.19.139.184:12222
                                xmr.2miners.com
                                tls
                                1.1kB
                                7.3kB
                                9
                                11
                              • 8.8.8.8:53
                                18.11.98.141.in-addr.arpa
                                dns
                                71 B
                                106 B
                                1
                                1

                                DNS Request

                                18.11.98.141.in-addr.arpa

                              • 8.8.8.8:53
                                62.13.109.52.in-addr.arpa
                                dns
                                71 B
                                145 B
                                1
                                1

                                DNS Request

                                62.13.109.52.in-addr.arpa

                              • 8.8.8.8:53
                                api.peer2profit.global
                                dns
                                BrowserUpdate.exe
                                68 B
                                116 B
                                1
                                1

                                DNS Request

                                api.peer2profit.global

                                DNS Response

                                104.26.9.6
                                172.67.69.54
                                104.26.8.6

                              • 8.8.8.8:53
                                6.9.26.104.in-addr.arpa
                                dns
                                69 B
                                131 B
                                1
                                1

                                DNS Request

                                6.9.26.104.in-addr.arpa

                              • 8.8.8.8:53
                                46.72.251.87.in-addr.arpa
                                dns
                                71 B
                                107 B
                                1
                                1

                                DNS Request

                                46.72.251.87.in-addr.arpa

                              • 8.8.8.8:53
                                xmr.2miners.com
                                dns
                                61 B
                                77 B
                                1
                                1

                                DNS Request

                                xmr.2miners.com

                                DNS Response

                                162.19.139.184

                              • 8.8.8.8:53
                                46.72.251.87.in-addr.arpa
                                dns
                                71 B
                                107 B
                                1
                                1

                                DNS Request

                                46.72.251.87.in-addr.arpa

                              • 8.8.8.8:53
                                184.139.19.162.in-addr.arpa
                                dns
                                73 B
                                102 B
                                1
                                1

                                DNS Request

                                184.139.19.162.in-addr.arpa

                              • 8.8.8.8:53
                                fp.check.peer2profit.site
                                dns
                                71 B
                                87 B
                                1
                                1

                                DNS Request

                                fp.check.peer2profit.site

                                DNS Response

                                162.19.176.4

                              • 8.8.8.8:53
                                github.com
                                dns
                                56 B
                                72 B
                                1
                                1

                                DNS Request

                                github.com

                                DNS Response

                                140.82.112.4

                              • 8.8.8.8:53
                                www.wikipedia.org
                                dns
                                63 B
                                108 B
                                1
                                1

                                DNS Request

                                www.wikipedia.org

                                DNS Response

                                208.80.154.224

                              • 8.8.8.8:53
                                twitter.com
                                dns
                                57 B
                                121 B
                                1
                                1

                                DNS Request

                                twitter.com

                                DNS Response

                                104.244.42.129
                                104.244.42.1
                                104.244.42.193
                                104.244.42.65

                              • 8.8.8.8:53
                                en.wikipedia.org
                                dns
                                62 B
                                107 B
                                1
                                1

                                DNS Request

                                en.wikipedia.org

                                DNS Response

                                208.80.154.224

                              • 8.8.8.8:53
                                4.176.19.162.in-addr.arpa
                                dns
                                71 B
                                105 B
                                1
                                1

                                DNS Request

                                4.176.19.162.in-addr.arpa

                              • 8.8.8.8:53
                                206.179.250.142.in-addr.arpa
                                dns
                                74 B
                                113 B
                                1
                                1

                                DNS Request

                                206.179.250.142.in-addr.arpa

                              • 8.8.8.8:53
                                196.168.217.172.in-addr.arpa
                                dns
                                74 B
                                112 B
                                1
                                1

                                DNS Request

                                196.168.217.172.in-addr.arpa

                              • 8.8.8.8:53
                                129.42.244.104.in-addr.arpa
                                dns
                                73 B
                                73 B
                                1
                                1

                                DNS Request

                                129.42.244.104.in-addr.arpa

                              • 8.8.8.8:53
                                4.112.82.140.in-addr.arpa
                                dns
                                71 B
                                115 B
                                1
                                1

                                DNS Request

                                4.112.82.140.in-addr.arpa

                              • 8.8.8.8:53
                                224.154.80.208.in-addr.arpa
                                dns
                                73 B
                                114 B
                                1
                                1

                                DNS Request

                                224.154.80.208.in-addr.arpa

                              • 8.8.8.8:53
                                api.blocklist.de
                                dns
                                62 B
                                78 B
                                1
                                1

                                DNS Request

                                api.blocklist.de

                                DNS Response

                                185.21.103.31

                              • 8.8.8.8:53
                                31.103.21.185.in-addr.arpa
                                dns
                                72 B
                                109 B
                                1
                                1

                                DNS Request

                                31.103.21.185.in-addr.arpa

                              • 8.8.8.8:53
                                otx.alienvault.com
                                dns
                                64 B
                                128 B
                                1
                                1

                                DNS Request

                                otx.alienvault.com

                                DNS Response

                                108.156.60.62
                                108.156.60.87
                                108.156.60.81
                                108.156.60.60

                              • 8.8.8.8:53
                                www.threatcrowd.org
                                dns
                                65 B
                                199 B
                                1
                                1

                                DNS Request

                                www.threatcrowd.org

                                DNS Response

                                44.237.49.181

                              • 8.8.8.8:53
                                62.60.156.108.in-addr.arpa
                                dns
                                72 B
                                128 B
                                1
                                1

                                DNS Request

                                62.60.156.108.in-addr.arpa

                              • 8.8.8.8:53
                                181.49.237.44.in-addr.arpa
                                dns
                                72 B
                                135 B
                                1
                                1

                                DNS Request

                                181.49.237.44.in-addr.arpa

                              • 8.8.8.8:53
                                fp-4.check.peer2profit.site
                                dns
                                73 B
                                89 B
                                1
                                1

                                DNS Request

                                fp-4.check.peer2profit.site

                                DNS Response

                                51.79.216.136

                              • 8.8.8.8:53
                                ubuntu.com
                                dns
                                56 B
                                104 B
                                1
                                1

                                DNS Request

                                ubuntu.com

                                DNS Response

                                185.125.190.20
                                185.125.190.21
                                185.125.190.29

                              • 8.8.8.8:53
                                one.one.one.one
                                dns
                                61 B
                                93 B
                                1
                                1

                                DNS Request

                                one.one.one.one

                                DNS Response

                                1.0.0.1
                                1.1.1.1

                              • 8.8.8.8:53
                                twitch.tv
                                dns
                                55 B
                                119 B
                                1
                                1

                                DNS Request

                                twitch.tv

                                DNS Response

                                151.101.66.167
                                151.101.2.167
                                151.101.130.167
                                151.101.194.167

                              • 8.8.8.8:53
                                www.twitch.tv
                                dns
                                59 B
                                110 B
                                1
                                1

                                DNS Request

                                www.twitch.tv

                                DNS Response

                                199.232.150.167

                              • 8.8.8.8:53
                                136.216.79.51.in-addr.arpa
                                dns
                                72 B
                                108 B
                                1
                                1

                                DNS Request

                                136.216.79.51.in-addr.arpa

                              • 8.8.8.8:53
                                20.190.125.185.in-addr.arpa
                                dns
                                73 B
                                128 B
                                1
                                1

                                DNS Request

                                20.190.125.185.in-addr.arpa

                              • 8.8.8.8:53
                                167.66.101.151.in-addr.arpa
                                dns
                                73 B
                                133 B
                                1
                                1

                                DNS Request

                                167.66.101.151.in-addr.arpa

                              • 8.8.8.8:53
                                1.0.0.1.in-addr.arpa
                                dns
                                66 B
                                95 B
                                1
                                1

                                DNS Request

                                1.0.0.1.in-addr.arpa

                              • 8.8.8.8:53
                                167.150.232.199.in-addr.arpa
                                dns
                                74 B
                                128 B
                                1
                                1

                                DNS Request

                                167.150.232.199.in-addr.arpa

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\Google\Chrome\Application\BrowserUpdate.exe

                                Filesize

                                4.4MB

                                MD5

                                dad5670c447512438535a15ffec5034d

                                SHA1

                                646c8877fadd7f011945ea2d2b221ea8fecaa857

                                SHA256

                                9fd44fe6e6d0bfe25d995d2b6479104cdcf44f68a350fc7eb981c99b5312dcb5

                                SHA512

                                b7d5da4b55a344581223f134034a25f7c02cd83348b6b95c3ea83b07b371d7a88f6f322529588301a9db823e93682c74f73dc3ce494847ad579bea08c557eb5c

                              • C:\Program Files\Google\Chrome\Application\BrowserUpdate.exe

                                Filesize

                                4.4MB

                                MD5

                                dad5670c447512438535a15ffec5034d

                                SHA1

                                646c8877fadd7f011945ea2d2b221ea8fecaa857

                                SHA256

                                9fd44fe6e6d0bfe25d995d2b6479104cdcf44f68a350fc7eb981c99b5312dcb5

                                SHA512

                                b7d5da4b55a344581223f134034a25f7c02cd83348b6b95c3ea83b07b371d7a88f6f322529588301a9db823e93682c74f73dc3ce494847ad579bea08c557eb5c

                              • C:\Program Files\Google\Chrome\Application\BrowserUpdate.exe

                                Filesize

                                4.4MB

                                MD5

                                dad5670c447512438535a15ffec5034d

                                SHA1

                                646c8877fadd7f011945ea2d2b221ea8fecaa857

                                SHA256

                                9fd44fe6e6d0bfe25d995d2b6479104cdcf44f68a350fc7eb981c99b5312dcb5

                                SHA512

                                b7d5da4b55a344581223f134034a25f7c02cd83348b6b95c3ea83b07b371d7a88f6f322529588301a9db823e93682c74f73dc3ce494847ad579bea08c557eb5c

                              • C:\Program Files\Google\Chrome\updater.exe

                                Filesize

                                56.6MB

                                MD5

                                0719c8bebea815061780ada047c77d85

                                SHA1

                                f38ec6878f127bb12e64393af78cb74f489dcca2

                                SHA256

                                089ba4c853ff529ba69c1977173c4b642d0aa62a3cf6d48a2fbe3b88c2f982f0

                                SHA512

                                c03661f55d6e263c94dcfe6463dd667e6d0a83c46136141a72b4d3a53d596c2ec4f45780f679f0a6df6509ba75e42fefaa571c305aed23736d4c64b680134564

                              • C:\Program Files\Google\Chrome\updater.exe

                                Filesize

                                56.6MB

                                MD5

                                0719c8bebea815061780ada047c77d85

                                SHA1

                                f38ec6878f127bb12e64393af78cb74f489dcca2

                                SHA256

                                089ba4c853ff529ba69c1977173c4b642d0aa62a3cf6d48a2fbe3b88c2f982f0

                                SHA512

                                c03661f55d6e263c94dcfe6463dd667e6d0a83c46136141a72b4d3a53d596c2ec4f45780f679f0a6df6509ba75e42fefaa571c305aed23736d4c64b680134564

                              • C:\Users\Admin\AppData\Local\Microsoft\Tu[6gheX9k.exe

                                Filesize

                                4.5MB

                                MD5

                                2b476e1317d92eb5d13dc01b254ef70a

                                SHA1

                                73b95b11dba56f414b06287908808879184306b5

                                SHA256

                                bc840027c4d7840b3feed3ffb5992094b168fc3fe01cad7a289a946d0482c489

                                SHA512

                                90083d915fd53f344ca94b521285dcf68ad7f7787948b5ad5218b8fea3210ce4e849f15f1f039233a8512aa1815ba6345f51e6a46f5ccea46bd60aecc12861a6

                              • C:\Users\Admin\AppData\Local\Microsoft\Tu[6gheX9k.exe

                                Filesize

                                4.5MB

                                MD5

                                2b476e1317d92eb5d13dc01b254ef70a

                                SHA1

                                73b95b11dba56f414b06287908808879184306b5

                                SHA256

                                bc840027c4d7840b3feed3ffb5992094b168fc3fe01cad7a289a946d0482c489

                                SHA512

                                90083d915fd53f344ca94b521285dcf68ad7f7787948b5ad5218b8fea3210ce4e849f15f1f039233a8512aa1815ba6345f51e6a46f5ccea46bd60aecc12861a6

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                944B

                                MD5

                                2e907f77659a6601fcc408274894da2e

                                SHA1

                                9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                SHA256

                                385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                SHA512

                                34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                1KB

                                MD5

                                b27d9f5366b4a5ecbf52c1d9e1a95d79

                                SHA1

                                e26b7d19e3c2568ea71cd743a3551507a50e39d4

                                SHA256

                                148ce60fd6f32461beb5bfd357e3be06cfc58c50d9ff5b568dfb3ec0c52c7578

                                SHA512

                                65d5e8ed59d20151dd7e744bd3823f81b4629a336e8e5b0ebcb7324fd3c25e2625678c98546db76a7e39919f1be21cdac65851ca148ac585a137a761279f8415

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                1KB

                                MD5

                                b27d9f5366b4a5ecbf52c1d9e1a95d79

                                SHA1

                                e26b7d19e3c2568ea71cd743a3551507a50e39d4

                                SHA256

                                148ce60fd6f32461beb5bfd357e3be06cfc58c50d9ff5b568dfb3ec0c52c7578

                                SHA512

                                65d5e8ed59d20151dd7e744bd3823f81b4629a336e8e5b0ebcb7324fd3c25e2625678c98546db76a7e39919f1be21cdac65851ca148ac585a137a761279f8415

                              • C:\Users\Admin\AppData\Local\Microsoft\n~n8ze1l.exe

                                Filesize

                                56.6MB

                                MD5

                                0719c8bebea815061780ada047c77d85

                                SHA1

                                f38ec6878f127bb12e64393af78cb74f489dcca2

                                SHA256

                                089ba4c853ff529ba69c1977173c4b642d0aa62a3cf6d48a2fbe3b88c2f982f0

                                SHA512

                                c03661f55d6e263c94dcfe6463dd667e6d0a83c46136141a72b4d3a53d596c2ec4f45780f679f0a6df6509ba75e42fefaa571c305aed23736d4c64b680134564

                              • C:\Users\Admin\AppData\Local\Microsoft\n~n8ze1l.exe

                                Filesize

                                56.6MB

                                MD5

                                0719c8bebea815061780ada047c77d85

                                SHA1

                                f38ec6878f127bb12e64393af78cb74f489dcca2

                                SHA256

                                089ba4c853ff529ba69c1977173c4b642d0aa62a3cf6d48a2fbe3b88c2f982f0

                                SHA512

                                c03661f55d6e263c94dcfe6463dd667e6d0a83c46136141a72b4d3a53d596c2ec4f45780f679f0a6df6509ba75e42fefaa571c305aed23736d4c64b680134564

                              • C:\Users\Admin\AppData\Local\Microsoft\q937-vn8.exe

                                Filesize

                                56.6MB

                                MD5

                                0b8ff333db2a5d1ed4a01965756fac3d

                                SHA1

                                15514ed3825c26eff55895ed150bcde3ecf87cd3

                                SHA256

                                33ed05f44788e4e32ff2db82b2157a6021b64c6d5de1b957297263f7f1bf4225

                                SHA512

                                d1e9822fc48ecd3b54aeafa5eb4bbc1ee756b0463c5c28421a15802056686206edeb6a0d1182d367e24d182ba4f5ddc52ea7d6fc53a00959658e8e8b8b18a871

                              • C:\Users\Admin\AppData\Local\Microsoft\q937-vn8.exe

                                Filesize

                                56.6MB

                                MD5

                                0b8ff333db2a5d1ed4a01965756fac3d

                                SHA1

                                15514ed3825c26eff55895ed150bcde3ecf87cd3

                                SHA256

                                33ed05f44788e4e32ff2db82b2157a6021b64c6d5de1b957297263f7f1bf4225

                                SHA512

                                d1e9822fc48ecd3b54aeafa5eb4bbc1ee756b0463c5c28421a15802056686206edeb6a0d1182d367e24d182ba4f5ddc52ea7d6fc53a00959658e8e8b8b18a871

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jskcl5mt.q50.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Windows\System32\drivers\etc\hosts

                                Filesize

                                3KB

                                MD5

                                00930b40cba79465b7a38ed0449d1449

                                SHA1

                                4b25a89ee28b20ba162f23772ddaf017669092a5

                                SHA256

                                eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                SHA512

                                cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                              • C:\Windows\System32\drivers\etc\hosts

                                Filesize

                                3KB

                                MD5

                                00930b40cba79465b7a38ed0449d1449

                                SHA1

                                4b25a89ee28b20ba162f23772ddaf017669092a5

                                SHA256

                                eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                SHA512

                                cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                Filesize

                                4KB

                                MD5

                                bdb25c22d14ec917e30faf353826c5de

                                SHA1

                                6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                SHA256

                                e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                SHA512

                                b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                1KB

                                MD5

                                b42c70c1dbf0d1d477ec86902db9e986

                                SHA1

                                1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                SHA256

                                8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                SHA512

                                57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                              • memory/1392-360-0x00000000007B0000-0x00000000007D0000-memory.dmp

                                Filesize

                                128KB

                              • memory/1392-365-0x00000000013E0000-0x0000000001400000-memory.dmp

                                Filesize

                                128KB

                              • memory/1392-376-0x00007FF777C50000-0x00007FF77843F000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/1392-384-0x00007FF777C50000-0x00007FF77843F000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/1392-372-0x00007FF777C50000-0x00007FF77843F000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/1392-367-0x00007FF777C50000-0x00007FF77843F000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/1464-366-0x00007FF76E5D0000-0x00007FF76E5FA000-memory.dmp

                                Filesize

                                168KB

                              • memory/1464-375-0x00007FF76E5D0000-0x00007FF76E5FA000-memory.dmp

                                Filesize

                                168KB

                              • memory/1572-157-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-145-0x000001189AD00000-0x000001189AD07000-memory.dmp

                                Filesize

                                28KB

                              • memory/1572-149-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-146-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-147-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-148-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-156-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-136-0x000001189A910000-0x000001189A913000-memory.dmp

                                Filesize

                                12KB

                              • memory/1572-155-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-154-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-144-0x000001189A910000-0x000001189A913000-memory.dmp

                                Filesize

                                12KB

                              • memory/1572-153-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-152-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1572-150-0x00007FF466CF0000-0x00007FF466E1D000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1968-370-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-301-0x0000000003580000-0x0000000003581000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-281-0x00000000031D0000-0x00000000031D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-293-0x0000000001720000-0x0000000001721000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-202-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-364-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-278-0x0000000001770000-0x0000000001771000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-280-0x00000000031B0000-0x00000000031B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-369-0x0000000001790000-0x0000000001791000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-296-0x00000000031C0000-0x00000000031C1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-298-0x0000000003570000-0x0000000003571000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-382-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-299-0x00000000035B0000-0x00000000035B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-374-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-300-0x0000000003590000-0x0000000003591000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-297-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-259-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-351-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-262-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-295-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-264-0x0000000000AC0000-0x00000000014C2000-memory.dmp

                                Filesize

                                10.0MB

                              • memory/1968-271-0x00000000017B0000-0x00000000017B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-272-0x00000000017C0000-0x00000000017C1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-274-0x00000000017A0000-0x00000000017A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-273-0x00000000031E0000-0x00000000031E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-276-0x00000000031F0000-0x00000000031F1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-275-0x0000000001780000-0x0000000001781000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-277-0x0000000003550000-0x0000000003551000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-279-0x00000000017E0000-0x00000000017E2000-memory.dmp

                                Filesize

                                8KB

                              • memory/1968-283-0x00000000017D0000-0x00000000017D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-282-0x0000000003560000-0x0000000003561000-memory.dmp

                                Filesize

                                4KB

                              • memory/1968-294-0x0000000001760000-0x0000000001761000-memory.dmp

                                Filesize

                                4KB

                              • memory/2340-263-0x00007FF76D630000-0x00007FF770EC8000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/2340-363-0x00007FF76D630000-0x00007FF770EC8000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/2340-352-0x00007FF76D630000-0x00007FF770EC8000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/2476-320-0x00000199423E0000-0x00000199423FA000-memory.dmp

                                Filesize

                                104KB

                              • memory/2476-319-0x0000019942380000-0x000001994238A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2476-316-0x0000019941F50000-0x0000019941F5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2476-314-0x00000199277E0000-0x00000199277F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2476-323-0x00000199423D0000-0x00000199423DA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2476-322-0x00000199423C0000-0x00000199423C6000-memory.dmp

                                Filesize

                                24KB

                              • memory/2476-321-0x0000019942390000-0x0000019942398000-memory.dmp

                                Filesize

                                32KB

                              • memory/2476-318-0x00000199423A0000-0x00000199423BC000-memory.dmp

                                Filesize

                                112KB

                              • memory/2476-311-0x0000019942160000-0x000001994217C000-memory.dmp

                                Filesize

                                112KB

                              • memory/2476-312-0x00000199277E0000-0x00000199277F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2476-313-0x00000199277E0000-0x00000199277F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2476-315-0x00007FF4952A0000-0x00007FF4952B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2728-229-0x000001DC7C410000-0x000001DC7C420000-memory.dmp

                                Filesize

                                64KB

                              • memory/2728-230-0x000001DC7C410000-0x000001DC7C420000-memory.dmp

                                Filesize

                                64KB

                              • memory/2728-232-0x000001DC7C410000-0x000001DC7C420000-memory.dmp

                                Filesize

                                64KB

                              • memory/3220-184-0x00007FF62B050000-0x00007FF62E8EA000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3220-239-0x00007FF62B050000-0x00007FF62E8EA000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3220-260-0x00007FF62B050000-0x00007FF62E8EA000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3228-385-0x00007FF6021C0000-0x00007FF6029AF000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/3228-381-0x00007FF6021C0000-0x00007FF6029AF000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/3228-373-0x00007FF6021C0000-0x00007FF6029AF000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/3228-368-0x00007FF6021C0000-0x00007FF6029AF000-memory.dmp

                                Filesize

                                7.9MB

                              • memory/3420-201-0x00007FF624770000-0x00007FF628008000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3420-168-0x00007FF624770000-0x00007FF628008000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3420-238-0x00007FF624770000-0x00007FF628008000-memory.dmp

                                Filesize

                                56.6MB

                              • memory/3428-186-0x000002A29AA70000-0x000002A29AA80000-memory.dmp

                                Filesize

                                64KB

                              • memory/3428-203-0x000002A29AA70000-0x000002A29AA80000-memory.dmp

                                Filesize

                                64KB

                              • memory/3428-185-0x000002A29AA70000-0x000002A29AA80000-memory.dmp

                                Filesize

                                64KB

                              • memory/3428-199-0x000002A2B5190000-0x000002A2B51B2000-memory.dmp

                                Filesize

                                136KB

                              • memory/3428-204-0x000002A29AA70000-0x000002A29AA80000-memory.dmp

                                Filesize

                                64KB

                              • memory/3632-353-0x00007FF412C70000-0x00007FF412C80000-memory.dmp

                                Filesize

                                64KB

                              • memory/3632-355-0x00000233B0A19000-0x00000233B0A1F000-memory.dmp

                                Filesize

                                24KB

                              • memory/3632-341-0x00000233B0A10000-0x00000233B0A20000-memory.dmp

                                Filesize

                                64KB

                              • memory/3632-339-0x00000233B0A10000-0x00000233B0A20000-memory.dmp

                                Filesize

                                64KB

                              • memory/3632-340-0x00000233B0A10000-0x00000233B0A20000-memory.dmp

                                Filesize

                                64KB

                              • memory/4148-217-0x000001F94A540000-0x000001F94A550000-memory.dmp

                                Filesize

                                64KB

                              • memory/4148-218-0x000001F94A540000-0x000001F94A550000-memory.dmp

                                Filesize

                                64KB

                              • memory/4148-219-0x000001F94A540000-0x000001F94A550000-memory.dmp

                                Filesize

                                64KB

                              • memory/4148-231-0x000001F94A540000-0x000001F94A550000-memory.dmp

                                Filesize

                                64KB

                              • memory/4192-176-0x0000000000400000-0x0000000000436000-memory.dmp

                                Filesize

                                216KB

                              • memory/4192-200-0x0000000000400000-0x0000000000436000-memory.dmp

                                Filesize

                                216KB

                              • memory/4308-143-0x00000000031F0000-0x0000000003226000-memory.dmp

                                Filesize

                                216KB

                              • memory/4308-137-0x00000000031F0000-0x0000000003226000-memory.dmp

                                Filesize

                                216KB

                              • memory/4308-135-0x0000000002450000-0x0000000002850000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4308-134-0x0000000002450000-0x0000000002850000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4308-133-0x00000000021D0000-0x00000000021D7000-memory.dmp

                                Filesize

                                28KB

                              • memory/4684-254-0x0000021944650000-0x0000021944660000-memory.dmp

                                Filesize

                                64KB

                              • memory/4684-252-0x0000021944650000-0x0000021944660000-memory.dmp

                                Filesize

                                64KB

                              • memory/4684-256-0x0000021944650000-0x0000021944660000-memory.dmp

                                Filesize

                                64KB

                              • memory/4684-247-0x0000021944650000-0x0000021944660000-memory.dmp

                                Filesize

                                64KB

                              We care about your privacy.

                              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.