fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:31 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
Size

1.8MB
MD5

95611edf8d94c4e065e4fb01fadac1bb
SHA1

4ff1afba7f8a792f6751dd2b716c8f4a8ffc9077
SHA256

fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359
SHA512

f0ebbec5ed5a3f2bf6783257e3fc69fdc6d5e667615fac7b1da15f2eb1975bf4ec25ba95cdcf9dd8ce32565030ef9e797e8a6047274576cf6335b574551452a8
SSDEEP

49152:Fx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAF7GAK/tlRtYLat:FvbjVkjjCAzJhRt6at

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 40 IoCs

pid	Process
468	Process not Found
2684	alg.exe
2520	aspnet_state.exe
2948	mscorsvw.exe
1980	mscorsvw.exe
672	mscorsvw.exe
1708	mscorsvw.exe
2592	ehRecvr.exe
1840	dllhost.exe
1292	elevation_service.exe
1564	GROOVE.EXE
2836	maintenanceservice.exe
1788	OSE.EXE
2568	mscorsvw.exe
2584	OSPPSVC.EXE
2752	mscorsvw.exe
1140	mscorsvw.exe
296	mscorsvw.exe
2484	mscorsvw.exe
2380	mscorsvw.exe
1592	mscorsvw.exe
2288	mscorsvw.exe
1784	mscorsvw.exe
432	mscorsvw.exe
1140	mscorsvw.exe
1964	mscorsvw.exe
1732	mscorsvw.exe
2688	mscorsvw.exe
2596	mscorsvw.exe
700	mscorsvw.exe
1572	mscorsvw.exe
2016	mscorsvw.exe
2128	mscorsvw.exe
1444	mscorsvw.exe
2652	mscorsvw.exe
2384	mscorsvw.exe
1892	mscorsvw.exe
2704	mscorsvw.exe
2764	mscorsvw.exe
320	mscorsvw.exe

Loads dropped DLL 4 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\alg.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2db9908a3f41c52b.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_th.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_lt.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_vi.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\GoogleCrashHandler.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_fil.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_bn.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_id.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_hr.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\GoogleUpdateSetup.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\psmachine.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_ja.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_fa.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_no.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_el.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	mscorsvw.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdateres_fr.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM3CD2.tmp\goopdate.dll	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	mscorsvw.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	mscorsvw.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ehome\ehRecvr.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C94156B0-E532-4974-84FC-7EDACC7C3E6E}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C94156B0-E532-4974-84FC-7EDACC7C3E6E}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2072	fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe
Token: SeShutdownPrivilege	1708	mscorsvw.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe
Token: SeShutdownPrivilege	1708	mscorsvw.exe
Token: SeShutdownPrivilege	1708	mscorsvw.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe
Token: SeShutdownPrivilege	1708	mscorsvw.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe
Token: SeDebugPrivilege	2684	alg.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe
Token: SeDebugPrivilege	672	mscorsvw.exe
Token: SeShutdownPrivilege	1708	mscorsvw.exe
Token: SeShutdownPrivilege	672	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 2568	672	mscorsvw.exe	40
PID 672 wrote to memory of 2568	672	mscorsvw.exe	40
PID 672 wrote to memory of 2568	672	mscorsvw.exe	40
PID 672 wrote to memory of 2568	672	mscorsvw.exe	40
PID 672 wrote to memory of 2752	672	mscorsvw.exe	42
PID 672 wrote to memory of 2752	672	mscorsvw.exe	42
PID 672 wrote to memory of 2752	672	mscorsvw.exe	42
PID 672 wrote to memory of 2752	672	mscorsvw.exe	42
PID 672 wrote to memory of 1140	672	mscorsvw.exe	43
PID 672 wrote to memory of 1140	672	mscorsvw.exe	43
PID 672 wrote to memory of 1140	672	mscorsvw.exe	43
PID 672 wrote to memory of 1140	672	mscorsvw.exe	43
PID 672 wrote to memory of 296	672	mscorsvw.exe	44
PID 672 wrote to memory of 296	672	mscorsvw.exe	44
PID 672 wrote to memory of 296	672	mscorsvw.exe	44
PID 672 wrote to memory of 296	672	mscorsvw.exe	44
PID 672 wrote to memory of 2484	672	mscorsvw.exe	45
PID 672 wrote to memory of 2484	672	mscorsvw.exe	45
PID 672 wrote to memory of 2484	672	mscorsvw.exe	45
PID 672 wrote to memory of 2484	672	mscorsvw.exe	45
PID 672 wrote to memory of 2380	672	mscorsvw.exe	46
PID 672 wrote to memory of 2380	672	mscorsvw.exe	46
PID 672 wrote to memory of 2380	672	mscorsvw.exe	46
PID 672 wrote to memory of 2380	672	mscorsvw.exe	46
PID 672 wrote to memory of 1592	672	mscorsvw.exe	47
PID 672 wrote to memory of 1592	672	mscorsvw.exe	47
PID 672 wrote to memory of 1592	672	mscorsvw.exe	47
PID 672 wrote to memory of 1592	672	mscorsvw.exe	47
PID 672 wrote to memory of 2288	672	mscorsvw.exe	50
PID 672 wrote to memory of 2288	672	mscorsvw.exe	50
PID 672 wrote to memory of 2288	672	mscorsvw.exe	50
PID 672 wrote to memory of 2288	672	mscorsvw.exe	50
PID 672 wrote to memory of 1784	672	mscorsvw.exe	51
PID 672 wrote to memory of 1784	672	mscorsvw.exe	51
PID 672 wrote to memory of 1784	672	mscorsvw.exe	51
PID 672 wrote to memory of 1784	672	mscorsvw.exe	51
PID 672 wrote to memory of 432	672	mscorsvw.exe	52
PID 672 wrote to memory of 432	672	mscorsvw.exe	52
PID 672 wrote to memory of 432	672	mscorsvw.exe	52
PID 672 wrote to memory of 432	672	mscorsvw.exe	52
PID 672 wrote to memory of 1140	672	mscorsvw.exe	53
PID 672 wrote to memory of 1140	672	mscorsvw.exe	53
PID 672 wrote to memory of 1140	672	mscorsvw.exe	53
PID 672 wrote to memory of 1140	672	mscorsvw.exe	53
PID 672 wrote to memory of 1964	672	mscorsvw.exe	54
PID 672 wrote to memory of 1964	672	mscorsvw.exe	54
PID 672 wrote to memory of 1964	672	mscorsvw.exe	54
PID 672 wrote to memory of 1964	672	mscorsvw.exe	54
PID 672 wrote to memory of 1732	672	mscorsvw.exe	55
PID 672 wrote to memory of 1732	672	mscorsvw.exe	55
PID 672 wrote to memory of 1732	672	mscorsvw.exe	55
PID 672 wrote to memory of 1732	672	mscorsvw.exe	55
PID 672 wrote to memory of 2688	672	mscorsvw.exe	56
PID 672 wrote to memory of 2688	672	mscorsvw.exe	56
PID 672 wrote to memory of 2688	672	mscorsvw.exe	56
PID 672 wrote to memory of 2688	672	mscorsvw.exe	56
PID 672 wrote to memory of 2596	672	mscorsvw.exe	57
PID 672 wrote to memory of 2596	672	mscorsvw.exe	57
PID 672 wrote to memory of 2596	672	mscorsvw.exe	57
PID 672 wrote to memory of 2596	672	mscorsvw.exe	57
PID 672 wrote to memory of 700	672	mscorsvw.exe	58
PID 672 wrote to memory of 700	672	mscorsvw.exe	58
PID 672 wrote to memory of 700	672	mscorsvw.exe	58
PID 672 wrote to memory of 700	672	mscorsvw.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe
"C:\Users\Admin\AppData\Local\Temp\fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 244 -NGENProcess 248 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 248 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 23c -NGENProcess 258 -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 244 -NGENProcess 264 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 238 -NGENProcess 258 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 238 -NGENProcess 258 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 244 -NGENProcess 1dc -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 274 -NGENProcess 254 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 274 -NGENProcess 278 -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 260 -NGENProcess 27c -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 260 -NGENProcess 274 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 27c -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 1d8 -NGENProcess 26c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 244 -NGENProcess 27c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1b0 -NGENProcess 28c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 274 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 260 -NGENProcess 294 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 250 -NGENProcess 27c -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 29c -NGENProcess 274 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 290 -NGENProcess 2a0 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 260 -NGENProcess 2a4 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1b0 -NGENProcess 2a0 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2704

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 154 -NGENProcess 15c -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1dc -NGENProcess 16c -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:320

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2592

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1840

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1292

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2836

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1788

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2584

Network

DNS

pywolwnvd.biz

alg.exe

Remote address:

8.8.8.8:53

Request

pywolwnvd.biz

IN A

Response

pywolwnvd.biz

IN A

34.41.229.245
POST

http://pywolwnvd.biz/yxuilgx

fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe

Remote address:

34.41.229.245:80

Request

POST /yxuilgx HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: pywolwnvd.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 936

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=4dff8ad165bce449e1c44f05dc41eb68|89.149.23.59|1703464335|1703464335|0|1|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

pywolwnvd.biz

alg.exe

Remote address:

8.8.8.8:53

Request

pywolwnvd.biz

IN A

Response

pywolwnvd.biz

IN A

34.41.229.245
DNS

pywolwnvd.biz

alg.exe

Remote address:

8.8.8.8:53

Request

pywolwnvd.biz

IN A
DNS

pywolwnvd.biz

alg.exe

Remote address:

8.8.8.8:53

Request

pywolwnvd.biz

IN A
POST

http://pywolwnvd.biz/sadmq

alg.exe

Remote address:

34.41.229.245:80

Request

POST /sadmq HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: pywolwnvd.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=f44982d11065dc855e9ea6eee8efb2f1|89.149.23.59|1703464336|1703464336|0|1|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

ssbzmoy.biz

alg.exe

Remote address:

8.8.8.8:53

Request

ssbzmoy.biz

IN A

Response

ssbzmoy.biz

IN A

34.128.82.12
DNS

ssbzmoy.biz

alg.exe

Remote address:

8.8.8.8:53

Request

ssbzmoy.biz

IN A
POST

http://ssbzmoy.biz/ljncbqbqgf

alg.exe

Remote address:

34.128.82.12:80

Request

POST /ljncbqbqgf HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: ssbzmoy.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=ded748d9793dd0f4d8061d899da03dfa|89.149.23.59|1703464341|1703464341|0|1|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

cvgrf.biz

alg.exe

Remote address:

8.8.8.8:53

Request

cvgrf.biz

IN A

Response

cvgrf.biz

IN A

104.198.2.251
DNS

cvgrf.biz

alg.exe

Remote address:

8.8.8.8:53

Request

cvgrf.biz

IN A
POST

http://cvgrf.biz/cmegvsakpg

alg.exe

Remote address:

104.198.2.251:80

Request

POST /cmegvsakpg HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: cvgrf.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:31 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=9b74d328da925a34ac8ac5a29bfedd8c|89.149.23.59|1703464351|1703464351|0|1|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

npukfztj.biz

alg.exe

Remote address:

8.8.8.8:53

Request

npukfztj.biz

IN A

Response

npukfztj.biz

IN A

34.174.61.199
DNS

npukfztj.biz

alg.exe

Remote address:

8.8.8.8:53

Request

npukfztj.biz

IN A
POST

http://npukfztj.biz/kcqmqawjuqu

alg.exe

Remote address:

34.174.61.199:80

Request

POST /kcqmqawjuqu HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: npukfztj.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=19db8856def2b0adce049216c0ed0bea|89.149.23.59|1703464352|1703464352|0|1|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

przvgke.biz

alg.exe

Remote address:

8.8.8.8:53

Request

przvgke.biz

IN A

Response

przvgke.biz

IN A

167.99.35.88
POST

http://przvgke.biz/mhyxfn

alg.exe

Remote address:

167.99.35.88:80

Request

POST /mhyxfn HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: przvgke.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 204 No Content

Server: nginx
Date: Mon, 25 Dec 2023 00:32:32 GMT
Connection: keep-alive
X-Sinkhole: Malware
DNS

zlenh.biz

alg.exe

Remote address:

8.8.8.8:53

Request

zlenh.biz

IN A

Response
DNS

zlenh.biz

alg.exe

Remote address:

8.8.8.8:53

Request

zlenh.biz

IN A
DNS

knjghuig.biz

alg.exe

Remote address:

8.8.8.8:53

Request

knjghuig.biz

IN A

Response

knjghuig.biz

IN A

34.128.82.12
DNS

knjghuig.biz

alg.exe

Remote address:

8.8.8.8:53

Request

knjghuig.biz

IN A
DNS

knjghuig.biz

alg.exe

Remote address:

8.8.8.8:53

Request

knjghuig.biz

IN A
POST

http://knjghuig.biz/x

alg.exe

Remote address:

34.128.82.12:80

Request

POST /x HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: knjghuig.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:32:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=73b634ebc6ab9e6260c98580f28bdccf|89.149.23.59|1703464356|1703464356|0|1|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

uhxqin.biz

alg.exe

Remote address:

8.8.8.8:53

Request

uhxqin.biz

IN A

Response
DNS

anpmnmxo.biz

alg.exe

Remote address:

8.8.8.8:53

Request

anpmnmxo.biz

IN A

Response
DNS

lpuegx.biz

alg.exe

Remote address:

8.8.8.8:53

Request

lpuegx.biz

IN A

Response

lpuegx.biz

IN A

82.112.184.197
DNS

vjaxhpbji.biz

alg.exe

Remote address:

8.8.8.8:53

Request

vjaxhpbji.biz

IN A

Response

vjaxhpbji.biz

IN A

82.112.184.197
DNS

vjaxhpbji.biz

alg.exe

Remote address:

8.8.8.8:53

Request

vjaxhpbji.biz

IN A
DNS

xlfhhhm.biz

alg.exe

Remote address:

8.8.8.8:53

Request

xlfhhhm.biz

IN A

Response

xlfhhhm.biz

IN A

34.29.71.138
POST

http://xlfhhhm.biz/ubbelkmnqci

alg.exe

Remote address:

34.29.71.138:80

Request

POST /ubbelkmnqci HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: xlfhhhm.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:13 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=f0cce875aed52080215e12a2379fec42|89.149.23.59|1703464453|1703464453|0|1|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

ifsaia.biz

alg.exe

Remote address:

8.8.8.8:53

Request

ifsaia.biz

IN A

Response

ifsaia.biz

IN A

34.143.166.163
POST

http://ifsaia.biz/dshfhgpp

alg.exe

Remote address:

34.143.166.163:80

Request

POST /dshfhgpp HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: ifsaia.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:14 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=8d38d3723d28fb1d97f9311835d97aa9|89.149.23.59|1703464454|1703464454|0|1|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

saytjshyf.biz

alg.exe

Remote address:

8.8.8.8:53

Request

saytjshyf.biz

IN A

Response

saytjshyf.biz

IN A

34.67.9.172
POST

http://saytjshyf.biz/ebj

alg.exe

Remote address:

34.67.9.172:80

Request

POST /ebj HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: saytjshyf.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:14 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=2c7e3e522c0680ffc9d773ff212e31e0|89.149.23.59|1703464454|1703464454|0|1|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

vcddkls.biz

alg.exe

Remote address:

8.8.8.8:53

Request

vcddkls.biz

IN A

Response

vcddkls.biz

IN A

34.128.82.12
DNS

vcddkls.biz

alg.exe

Remote address:

8.8.8.8:53

Request

vcddkls.biz

IN A
POST

http://vcddkls.biz/gl

alg.exe

Remote address:

34.128.82.12:80

Request

POST /gl HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: vcddkls.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=4e10e1c7236d40cf239b5b9246dfba39|89.149.23.59|1703464456|1703464456|0|1|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

fwiwk.biz

alg.exe

Remote address:

8.8.8.8:53

Request

fwiwk.biz

IN A

Response

fwiwk.biz

IN A

67.225.218.6
POST

http://fwiwk.biz/jffbnnuxb

alg.exe

Remote address:

67.225.218.6:80

Request

POST /jffbnnuxb HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: fwiwk.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780
POST

http://fwiwk.biz/akyxo

alg.exe

Remote address:

67.225.218.6:80

Request

POST /akyxo HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: fwiwk.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780
DNS

tbjrpv.biz

alg.exe

Remote address:

8.8.8.8:53

Request

tbjrpv.biz

IN A

Response

tbjrpv.biz

IN A

34.91.32.224
POST

http://tbjrpv.biz/fshjdurrtxnlx

alg.exe

Remote address:

34.91.32.224:80

Request

POST /fshjdurrtxnlx HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: tbjrpv.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=d27ff49423f2aa0a1a7b4e352b4056ca|89.149.23.59|1703464460|1703464460|0|1|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

deoci.biz

alg.exe

Remote address:

8.8.8.8:53

Request

deoci.biz

IN A

Response

deoci.biz

IN A

34.174.78.212
POST

http://deoci.biz/roadlbvbgvrqmh

alg.exe

Remote address:

34.174.78.212:80

Request

POST /roadlbvbgvrqmh HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: deoci.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:23 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=e49a1d594ace338e103f4f5835e9ecc7|89.149.23.59|1703464463|1703464463|0|1|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

gytujflc.biz

alg.exe

Remote address:

8.8.8.8:53

Request

gytujflc.biz

IN A

Response
DNS

qaynky.biz

alg.exe

Remote address:

8.8.8.8:53

Request

qaynky.biz

IN A

Response

qaynky.biz

IN A

34.143.166.163
DNS

qaynky.biz

alg.exe

Remote address:

8.8.8.8:53

Request

qaynky.biz

IN A
DNS

qaynky.biz

alg.exe

Remote address:

8.8.8.8:53

Request

qaynky.biz

IN A
POST

http://qaynky.biz/yffcprrfg

alg.exe

Remote address:

34.143.166.163:80

Request

POST /yffcprrfg HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: qaynky.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=d5f70d9f87b17926134b72f75850befb|89.149.23.59|1703464475|1703464475|0|1|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

bumxkqgxu.biz

alg.exe

Remote address:

8.8.8.8:53

Request

bumxkqgxu.biz

IN A

Response

bumxkqgxu.biz

IN A

34.174.61.199
POST

http://bumxkqgxu.biz/bbhfu

alg.exe

Remote address:

34.174.61.199:80

Request

POST /bbhfu HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: bumxkqgxu.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=6c81778e3093fe5caeca19331032c95a|89.149.23.59|1703464476|1703464476|0|1|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

dwrqljrr.biz

alg.exe

Remote address:

8.8.8.8:53

Request

dwrqljrr.biz

IN A

Response

dwrqljrr.biz

IN A

34.41.229.245
POST

http://dwrqljrr.biz/ilkfyu

alg.exe

Remote address:

34.41.229.245:80

Request

POST /ilkfyu HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: dwrqljrr.biz
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400
Content-Length: 780

Response

HTTP/1.1 200 OK

Server: nginx
Date: Mon, 25 Dec 2023 00:34:37 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=992d9f8f91c15bd2e74ab7d3bc8a6839|89.149.23.59|1703464477|1703464477|0|1|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
Set-Cookie: snkz=89.149.23.59; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
DNS

nqwjmb.biz

alg.exe

Remote address:

8.8.8.8:53

Request

nqwjmb.biz

IN A

Response

nqwjmb.biz

IN A

34.94.245.237

34.41.229.245:80

http://pywolwnvd.biz/yxuilgx

http

fd994a4d72773aa0ed4b215504871c245be7576a0e8679cf3192de8133160359.exe

4.3kB
950 B
9
3

HTTP Request

POST http://pywolwnvd.biz/yxuilgx

HTTP Response

200
34.41.229.245:80

http://pywolwnvd.biz/sadmq

http

alg.exe

1.5kB
705 B
8
7

HTTP Request

POST http://pywolwnvd.biz/sadmq

HTTP Response

200
34.128.82.12:80

http://ssbzmoy.biz/ljncbqbqgf

http

alg.exe

1.5kB
663 B
7
6

HTTP Request

POST http://ssbzmoy.biz/ljncbqbqgf

HTTP Response

200
104.198.2.251:80

http://cvgrf.biz/cmegvsakpg

http

alg.exe

1.5kB
661 B
9
6

HTTP Request

POST http://cvgrf.biz/cmegvsakpg

HTTP Response

200
34.174.61.199:80

http://npukfztj.biz/kcqmqawjuqu

http

alg.exe

1.4kB
664 B
6
6

HTTP Request

POST http://npukfztj.biz/kcqmqawjuqu

HTTP Response

200
167.99.35.88:80

http://przvgke.biz/mhyxfn

http

alg.exe

1.5kB
376 B
9
6

HTTP Request

POST http://przvgke.biz/mhyxfn

HTTP Response

204
34.128.82.12:80

http://knjghuig.biz/x

http

alg.exe

1.4kB
664 B
6
6

HTTP Request

POST http://knjghuig.biz/x

HTTP Response

200
82.112.184.197:80

lpuegx.biz

alg.exe

152 B
3
82.112.184.197:80

lpuegx.biz

alg.exe

152 B
3
82.112.184.197:80

vjaxhpbji.biz

alg.exe

152 B
3
82.112.184.197:80

vjaxhpbji.biz

alg.exe

152 B
3
34.29.71.138:80

http://xlfhhhm.biz/ubbelkmnqci

http

alg.exe

1.5kB
663 B
7
6

HTTP Request

POST http://xlfhhhm.biz/ubbelkmnqci

HTTP Response

200
34.143.166.163:80

http://ifsaia.biz/dshfhgpp

http

alg.exe

1.4kB
654 B
6
6

HTTP Request

POST http://ifsaia.biz/dshfhgpp

HTTP Response

200
34.67.9.172:80

http://saytjshyf.biz/ebj

http

alg.exe

1.4kB
657 B
6
6

HTTP Request

POST http://saytjshyf.biz/ebj

HTTP Response

200
34.128.82.12:80

http://vcddkls.biz/gl

http

alg.exe

1.4kB
655 B
6
6

HTTP Request

POST http://vcddkls.biz/gl

HTTP Response

200
67.225.218.6:80

http://fwiwk.biz/jffbnnuxb

http

alg.exe

1.4kB
252 B
6
6

HTTP Request

POST http://fwiwk.biz/jffbnnuxb
67.225.218.6:80

http://fwiwk.biz/akyxo

http

alg.exe

2.3kB
212 B
8
5

HTTP Request

POST http://fwiwk.biz/akyxo
34.91.32.224:80

http://tbjrpv.biz/fshjdurrtxnlx

http

alg.exe

1.4kB
662 B
6
6

HTTP Request

POST http://tbjrpv.biz/fshjdurrtxnlx

HTTP Response

200
34.174.78.212:80

http://deoci.biz/roadlbvbgvrqmh

http

alg.exe

1.5kB
661 B
7
6

HTTP Request

POST http://deoci.biz/roadlbvbgvrqmh

HTTP Response

200
34.143.166.163:80

http://qaynky.biz/yffcprrfg

http

alg.exe

1.5kB
654 B
8
6

HTTP Request

POST http://qaynky.biz/yffcprrfg

HTTP Response

200
34.174.61.199:80

http://bumxkqgxu.biz/bbhfu

http

alg.exe

2.6kB
625 B
7
5

HTTP Request

POST http://bumxkqgxu.biz/bbhfu

HTTP Response

200
34.41.229.245:80

http://dwrqljrr.biz/ilkfyu

http

alg.exe

2.6kB
556 B
7
3

HTTP Request

POST http://dwrqljrr.biz/ilkfyu

HTTP Response

200
34.94.245.237:80

nqwjmb.biz

alg.exe

52 B
1

8.8.8.8:53

pywolwnvd.biz

dns

alg.exe

59 B
75 B
1
1

DNS Request

pywolwnvd.biz

DNS Response

34.41.229.245
8.8.8.8:53

pywolwnvd.biz

dns

alg.exe

177 B
75 B
3
1

DNS Request

pywolwnvd.biz

DNS Request

pywolwnvd.biz

DNS Request

pywolwnvd.biz

DNS Response

34.41.229.245
8.8.8.8:53

ssbzmoy.biz

dns

alg.exe

114 B
73 B
2
1

DNS Request

ssbzmoy.biz

DNS Request

ssbzmoy.biz

DNS Response

34.128.82.12
8.8.8.8:53

cvgrf.biz

dns

alg.exe

110 B
71 B
2
1

DNS Request

cvgrf.biz

DNS Request

cvgrf.biz

DNS Response

104.198.2.251
8.8.8.8:53

npukfztj.biz

dns

alg.exe

116 B
74 B
2
1

DNS Request

npukfztj.biz

DNS Request

npukfztj.biz

DNS Response

34.174.61.199
8.8.8.8:53

przvgke.biz

dns

alg.exe

57 B
73 B
1
1

DNS Request

przvgke.biz

DNS Response

167.99.35.88
8.8.8.8:53

zlenh.biz

dns

alg.exe

110 B
117 B
2
1

DNS Request

zlenh.biz

DNS Request

zlenh.biz
8.8.8.8:53

knjghuig.biz

dns

alg.exe

174 B
74 B
3
1

DNS Request

knjghuig.biz

DNS Request

knjghuig.biz

DNS Request

knjghuig.biz

DNS Response

34.128.82.12
8.8.8.8:53

uhxqin.biz

dns

alg.exe

56 B
118 B
1
1

DNS Request

uhxqin.biz
8.8.8.8:53

anpmnmxo.biz

dns

alg.exe

58 B
120 B
1
1

DNS Request

anpmnmxo.biz
8.8.8.8:53

lpuegx.biz

dns

alg.exe

56 B
72 B
1
1

DNS Request

lpuegx.biz

DNS Response

82.112.184.197
8.8.8.8:53

vjaxhpbji.biz

dns

alg.exe

118 B
75 B
2
1

DNS Request

vjaxhpbji.biz

DNS Request

vjaxhpbji.biz

DNS Response

82.112.184.197
8.8.8.8:53

xlfhhhm.biz

dns

alg.exe

57 B
73 B
1
1

DNS Request

xlfhhhm.biz

DNS Response

34.29.71.138
8.8.8.8:53

ifsaia.biz

dns

alg.exe

56 B
72 B
1
1

DNS Request

ifsaia.biz

DNS Response

34.143.166.163
8.8.8.8:53

saytjshyf.biz

dns

alg.exe

59 B
75 B
1
1

DNS Request

saytjshyf.biz

DNS Response

34.67.9.172
8.8.8.8:53

vcddkls.biz

dns

alg.exe

114 B
73 B
2
1

DNS Request

vcddkls.biz

DNS Request

vcddkls.biz

DNS Response

34.128.82.12
8.8.8.8:53

fwiwk.biz

dns

alg.exe

55 B
71 B
1
1

DNS Request

fwiwk.biz

DNS Response

67.225.218.6
8.8.8.8:53

tbjrpv.biz

dns

alg.exe

56 B
72 B
1
1

DNS Request

tbjrpv.biz

DNS Response

34.91.32.224
8.8.8.8:53

deoci.biz

dns

alg.exe

55 B
71 B
1
1

DNS Request

deoci.biz

DNS Response

34.174.78.212
8.8.8.8:53

gytujflc.biz

dns

alg.exe

58 B
120 B
1
1

DNS Request

gytujflc.biz
8.8.8.8:53

qaynky.biz

dns

alg.exe

168 B
72 B
3
1

DNS Request

qaynky.biz

DNS Request

qaynky.biz

DNS Request

qaynky.biz

DNS Response

34.143.166.163
8.8.8.8:53

bumxkqgxu.biz

dns

alg.exe

59 B
75 B
1
1

DNS Request

bumxkqgxu.biz

DNS Response

34.174.61.199
8.8.8.8:53

dwrqljrr.biz

dns

alg.exe

58 B
74 B
1
1

DNS Request

dwrqljrr.biz

DNS Response

34.41.229.245
8.8.8.8:53

nqwjmb.biz

dns

alg.exe

56 B
72 B
1
1

DNS Request

nqwjmb.biz

DNS Response

34.94.245.237

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
562KB

MD5
930b531bb41827d76756d768cc0ebb18

SHA1
b2dc5ae6a9c22f770ea2b60610609f15f1c8fd01

SHA256
3b06c7c7ea5f653b8845409ff8cc29baa0d4444e396d2a224dbc0854b62098f0

SHA512
09c632112318699d2f614b7f8692333ce58b75ba30d62b01e4a728a9d9c1051e7ea11f53b22852802309b1220f1e568f6f493658060ee33ae194e94f8ca6a0e3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
649KB

MD5
4afa810bddcefbfa32051df5283bc7a4

SHA1
5433d8db2b9270c5d3efd5cd9afb474b15e1679a

SHA256
bf646148788f8efd8b0be4ebce5984eede26e91d49ff1f60dc5bccbd33eaa424

SHA512
c322ffb70e514c1c09a9eb8c5c86b1f2b62b8add99112cd01ed608ff1dc3175e3faf2b56ce36e969931b6c01c67e5e696cbfc77cc238b9c29814af6664409289

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
584KB

MD5
36d747b8bfff509b36d8bfbab5094d81

SHA1
211fd010bf06a451bd48ca13f7893a075fc2a07e

SHA256
224f03099c35602ff13f0d64c41eb379c9ff189c4a49b7e6769ca0b4d5d5ffcf

SHA512
c8abfae8af25d91f609aa3f2ac8fdf3b71fbd374df4bbc700b714cd042dbe98b872b772337247855c41f6a6c13cdba7a05ff458684558be8c81e45f465a72b70

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
676KB

MD5
216167304bb0d2aa7ef11ab99cd15803

SHA1
2c692bec787c010bf461c50769abd5340594b4db

SHA256
b5b992ca49ae308a9678665e685f143ee7758751b784adedebad88c885133290

SHA512
c98c6d932d884b6a7423c465180b10ebaa2456eabe3bca6eb65345895c7225864b15fa31f7febd9049d7b03a91708f7d8bfc9597daee65781be968125ee76345

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
754KB

MD5
b64fd58a86fd3de184d5f2b4ec46921c

SHA1
54236d0083172986445915eaa5e63a1cb3d97ff8

SHA256
dd24a7f02f8d84e06656268b16e70bfb17b9629a795c730283520cda98207710

SHA512
5ae6f77e8abd8c6f03376d3555d7796c94b26bd642708d6f3d62b5401228c921445e4e6e7e71e8ef052194e3b89fe0315f58aee00737710026bc5f9902adb36b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
738KB

MD5
578e34a10c24154f24c206197a75af28

SHA1
f7bf9c882a26c45a2ebfaebf82c0c0e690a72d62

SHA256
1f124107adcbd828c002a6d17730c1cbc56c327103eaffc5d9faa0dcd961b72a

SHA512
7abb91e4673ec66ae16ea1b6d08fdb8510e0a0ffccedda679136088b80ee526947f19c90b70a62188309cb4702767eaea395b12298cda19427f7288bb892c5dc

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
433KB

MD5
d5097c3d347470daa39e2e1bab9443e5

SHA1
f452b9fb6ed9af27ba9e2e49aba39ea32d56c062

SHA256
5cb52b0a3b0b9a0984747a8b7692f9666d69ea3b0849749daa3538ccb6b14b37

SHA512
3293cd9dc7789e92fa3d0b455539c4878d8a527ae147af893c72f46a2b128ea0fe10181af79d7992b383b819bc055d4ba4fe22221c1e2b0cca8c9493c91d3e5f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
287KB

MD5
4706dfe8264df7d229bec24aefd6d3df

SHA1
ed15866fbb0a0e6cbd2dd7ae648431a9b3df9641

SHA256
8d12f9b51658470ed240005019421fd4a586e6c5c150e7cb20dc9af763ff9621

SHA512
3d689f408c28e1f1eef61b216efbb90cac33f64973ee090a34220473c6122067602002b4fdbc6cbf9ffab5ff29e1d4ab18a54cfedc8464d13fea330fcf4a59ac

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
548KB

MD5
23a7c7d8da167e5b6c0d81795e379b55

SHA1
ffe3b40f9fb8bac979b64bffbca3e5781fc3b48f

SHA256
15cf90ea2ccc44d69d0a6776cd29d2eb6de52e092dcad3e19247c63c2d94748f

SHA512
c6d973d6bfd9d309cbe873830411f572d85a51e3dcff0a2bd238e151f33cb15f18a3ef4952d031ad91c9895b7cd33b308f2c5b7ea2b9a75364c5201107771398

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
372KB

MD5
9a5a2e8b90694aba58f2a31fb4605143

SHA1
43b4f012a442b4ccb0a4a6618bc0ed1612388317

SHA256
6a51ca9c304de278f594dffdba14b20cf2e429d29b40c2a103a4df8bfd9edbb5

SHA512
ac7763408c11381181d70128fdd2070e5ddd24c2be031e45b168f8d599407dd719f6b2a8b396a89cc63ab1e7d146ea4395c1e6b125a0ef2dfd6cfc642f4589ae

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
413KB

MD5
fb5eca9937995dc33ac7abb0f7202e73

SHA1
a71c111df8bbbb5dfef7065228257fa554acb597

SHA256
7b5c0f2a67db28706df9d2be6a01066769ab4a415214d147df6b9f3427b8c524

SHA512
b974898fad9a25f2cfde2c40e500fb2afd35ffdd794bf30ba9442184758a46fcfe06db381ca8d910cbeffa1a98333f5ad16935e28631cfb1837c57b2fe6b4b16

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
511KB

MD5
5bf63522e404706c2ee7dacaefa7cc2e

SHA1
a4fc98938046efe6d5d55eef44b725c5f60b61c6

SHA256
0d170198b51749980d6a4cfed06778f9c7fed2d13d99639ffe215e043a66259a

SHA512
17f27d18c3fe3c01fbe055e2b5430f3224b945bf0156401649c139ddbd7bffb0fae1cb8ce83b52e985243816c50824f1f187aa0e2fe818836e17306d3e9d19d2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
1.0MB

MD5
30ba6ebc5e1a3c5d98e058fe4363ea13

SHA1
1ef24ba69e4fc2e563451317fb1fceba3384931a

SHA256
9ee82511968809ad401a6cd27ce3d0f7b738d27faa788f956140de8d6a78c8f6

SHA512
9998614fb559c60590b9dffc31d5e597b9ee5189433bb83ba681af01edd65a4e0247acc19c4462841fabeb9aa27f2bbb55abb8ca97e3bff4e148b6bdb0601555

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
336KB

MD5
1df29b791bc448a0fce41a1593df6b37

SHA1
78b33d0c0d9308efc83c80d5b38b9a9c00fa57f0

SHA256
07d38bfc2446e34fff4b517b5cce9b2adfae97181ce1c5daa958e7b186339b5e

SHA512
f9d123ffa491c2e679aaf03e21beda91132f66130dd2ab8a8ba9d96d09781abcdd3a54e1ed8fda48531b7a14bf567253b72a43164756b46d5c912d1d49431cd3

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
432KB

MD5
b9bf0c15854586db50633a9e78eaca1d

SHA1
8ec70d2b42a4d75160d03189602992f4dfabf9b4

SHA256
91b02082d4f90ef617b1ce16d5cfa1952606a059d037def72807b7817234d0cc

SHA512
4187f94824566581858c31f8370b99c7890cff8258e3699f8f2e662990dc4c7348a71c18bebfc26615ad523a749230b60bd5fda16d45794acba3ac4bb336d062

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
197KB

MD5
34e5c0f3baa89530324b50e25c806bfc

SHA1
bb171fc9f5f47c7cbe0456d8fc3dc7c785f2502e

SHA256
4ef87c9feabbc52b4e112d6b6b9e90112e28a8110fba1ee20119b802afd185a3

SHA512
482e83c74539aaef58b2ca012685237784bc5be5947910d1408a4a9700eac987db76cad6d3da7aaa4e52a254de09e935175ba794711579e865d043f992aeeece

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
9bf7afd8a477cdd71a43262f3561dabb

SHA1
486fc92e8d699f9feac0ef82a0745d0927466a3a

SHA256
806abb9b1b1e7915f476809e9b31b11812c27ea0708ba374b8730dd91fc4542f

SHA512
c265584a2fa0a81e677293d66cbda728118b22c695b41afbe09cf1b8f440b663c60b68a0437bd0f93cca26ea3edf3872989fb0ab382cf27b645ba1d3e1d536b7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
230KB

MD5
ab681cf8cecfc7bb7b3ee59b05a36472

SHA1
526ab9aa62ed70a0e7e3636ee5273056520c26b2

SHA256
eb265a35dbad5ad4e51bd84b2978b37774ed4d02e6f50db27348879ed25db479

SHA512
c4cd0dde002b9234cd5f0139c2cdbcf1c8a677ed3cb7600b9337e7063fe8ba1e10463aa2e54403358864594359cf428d8f3e30c5445cdd0b538ed6736bcb739f

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
250KB

MD5
684b7d0cf9f24dbc495ee038e0fda662

SHA1
573d6958f6ee439cbba936252c7d7cae5eeeee32

SHA256
aa673cd98c86cc9c56b3abba9c0881d14cdca8162649b9fba958fe8cbc40881e

SHA512
5324216ccfd3f31ce76d2c8b0644b8784609cfd5727801f253267b0942a2d7e012a71ea2741ae117db8b7f123e3c4d0c0fe05ce4e8ce34aa2a5d9de93904e634

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

Filesize
416KB

MD5
996b7918769703c36f8835fa42fc8537

SHA1
109cd896894cf66437d2e3314f4d088e01208d75

SHA256
e999f5a37dd64cc4c03513ed0887249462fb57679ef54b25b11f388c0f4478ba

SHA512
fd9d3cab795ef6ecdf7ab4597f3edd8d7fde580d871d7b3f43992bff9a8e197f939e9493177d6561a0b01d21379816b8e600ffcdaeb132128d172c841624c49f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
106KB

MD5
18cf73d604c9bbcd34e3bab395772a84

SHA1
0afe447dbe8f7b1839e962ccda5f5324d8f9b95c

SHA256
4afcba3d66c74766348e20cb73ab105d66a578721c099e5b73c30742b0e57e19

SHA512
a20be0a12112747d5e1a0bffa42efc729b31ac66b14ef23edaa547619cc7b6af5fa8bcfbef68430905536c4f94f16ad3edf6158ff69e286fb366f1983666e61e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
21KB

MD5
2156ef48c2670ff15b1e7cebd16ac4ed

SHA1
86203beab1b6957af5fb52600314dc76c681ef31

SHA256
01c1fef7d88a52599f0bf3e4d4f3734dc77e5e8c6e61f04b5110fb8f056851d9

SHA512
05ba02aa6b79f793d79a086a99ba91c4bc2e30bd6a49a147b9a03dd485578d3d709f0ede4f0bffe6e96f132dc182dd73e84df2be601433e061ed65e45ddffda7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
75KB

MD5
1c15e84dc5532ea46960536704f52ae6

SHA1
f7363a65ada38392f73aca93ca88e7f553fb581a

SHA256
17779beeb1b7b7541ab9705a5986314edc00b4cebedb64ee86a1f57c3b3199d2

SHA512
ed56aeff4b4b9e36cc339586fbe2aaa2611528157ff3b950643dc86109b821fcd4538e3c0124f071f7972461514a6d8d76e616b6abdbe87b86d144b6ffc5705c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
560KB

MD5
a0a301c419fc896d8c9b5364c481d9df

SHA1
ea4a14e3505306a2b29694c07e257c3bd6506c4d

SHA256
0222076892ec6938f4682ac54ed2391dde8a60b0494d7cbc65a0ecb9546af7e7

SHA512
4fda5a0f3e1c902c3d49908e08f4f77c53a118b00ff1a5c08a2aa74d44ff228000f4c61e80b7f94000f6410d6aa22cd111cc7741f908cd6de261bceac86c1dc3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
136KB

MD5
7554985b9629fe69296f0ef392fdc081

SHA1
ff10ddc2a77d19b8d6e26ffe7ffb4d0592e2faa5

SHA256
22688a6a7e50a06e5fc0795b6e5321a2470f6ff2ac918a0930127528a1a8048a

SHA512
9fe7445d9c0fd6d348c1467f0001ab1cd5b751f0827088959ec97a5f2f6c70a2aa17290013de1ef8d79a26d41f8c970f7fe5938583eb927d3748416daabd54e5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
270KB

MD5
6eac9420b31496c175b7e7a31dde3e17

SHA1
618100c45ed9fda78c8a8c586ab5dc85e68e24c2

SHA256
982a7946cc997c79c825c707115fadc34efa0faadcd0c338179e0b7740e7b59a

SHA512
761412f6ef37a95b2708bd2467c273e080ed21240137f60766634328347364f69beceb0c1345f121a66c1e34a4800831b69ae4ddd6f72f4859b2cff1ae641e58

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.2MB

MD5
d7238672e3b9833b1558c53a5ca3958d

SHA1
72e3fea5fb9011703f5030fc0f74afb426112e60

SHA256
4297464ae4f5d39b9a98da730b7912b11ca97738924417745804816a95447db8

SHA512
e0d1d63cd5ec65c8ea08c9ea4314fb773774c9c8fd89d2532b627e0222b8a13d1479394dd0b216235734319de51f6103a763c167a8c9ae3f5fb8a3af145ef181

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.1MB

MD5
df3c61076ec69c73334154fa6100f0ed

SHA1
45ae9fcadfc8bd51b9be0f0152a59d3b3f8e6a74

SHA256
4565780b035670663e15e02d2925bc9f26bc6794a4e0063482b96d191b2db2b9

SHA512
1d437d13c775be6127549cae36d80d753107745471614ed2fc375c82c45c25e6bca55932696171cd593f0232d5f1c766d715582e15d99a2d3a79b4ac118fa75f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
128KB

MD5
a83ceedf580b938ce2797563c7e79816

SHA1
325aee8752d6dee9b97ccf11d237379dbe635250

SHA256
bee2fb036d3097d7840e3f89068f0dc4ab4418807c40b7acd64fdd5399bee39d

SHA512
c2199247f1df42a720ac2ddcf00a96073d09112370845cf38b289fbb80c37b801c79e684dad2ee60933ac647ad679d022a75fcc8f187a8cff6babd0e8e09bf90

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
159KB

MD5
cf22d118d0e8536eab3e2fc4e1d04ab2

SHA1
92a12278b1c218649faa6e3cb0271734cd0e29bb

SHA256
f4fc9419dfa93de6b2204a651db0063d45aa210ee341b967b99f110479cf7d1e

SHA512
b7e45892f8286813c64c71955594bfa7191a75c85644aee5a479e6b5ef22ef336c2675da2e849bc791954e36b5c14a280d77870577812496a7a39770ee4aef40

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
26KB

MD5
2b28b0dcc5df894370c0aefc37dea088

SHA1
035e391ce1cb4380982cff95b34da0762a46ffc8

SHA256
3ca3be16b647ffdaebe2228a57635a8de411cc2dc7dd4e8be173f978b7389c05

SHA512
d1fae298bb73fb7d97d38a756772834cc76d3a171f5d1e462b280de1efb17f385ed182242e3d6bb3319091e2d968ed5a7ba27492c9fdaf618cd224192fce022f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
45KB

MD5
443590761912177e60a014349a7a9f48

SHA1
5b29420e0bf00b208333b4550c14e79a473ae219

SHA256
30864e7813c9b4f886f5b0e5d835c515795dd14cb6d1158d919d8c040e028f08

SHA512
803e191fd9fa5ec3a84d108073f4b90aed0087e31e4e6805bc5fb63d1aca07ad5407ad65b6cac1213cb9bd5d76af4c1a8c148fbadd979bbdd2eb4f894bad9d32

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
169KB

MD5
7a30b4db691a22c3be5b55c8d26f377b

SHA1
007c0826fa414a4ba7f3e9a1f896a5a1dcf73146

SHA256
e19475e704e5c71c471af0a63865af618d64ebd7602af72d9603a2f936d5ef75

SHA512
18d23e84c1af08ef2a5c56f3c18ed53c85a61788c68fe6ad945539e9d8d4768e51e4e6933064c29eca406e3674dfd71b1661d409a9b17b717c8ee2dae0e7b00c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
461KB

MD5
e9af31a70cc1ef8387cd3a939323a664

SHA1
f1971609741dfe17576c603cb7d2b318fc672160

SHA256
1d9e00dc168622dff994e41b151999f79429f4a49e870a6aaabcec07189de68b

SHA512
4f1df936227e3af3c72203bdf01eb8ecaf745e2fcf46ddea4ea0e5c9086d389bb25a64a275a544da01ae908d4345cf59e561ab021c37cb4e435e9f018eefb8da

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
601KB

MD5
a767f0f11cd0c924d2977b22e90d5f3a

SHA1
9d8909fce6e37b5d6be9b4ea5569302b86d7dcac

SHA256
e7ae1ba433a6e3c1a84966029d0256857b8e84e020dbbbf2f9fb41aafcbd7327

SHA512
b9a435a6342fcc0280c01a38df40666a26dc6995ca48b01cbe3ae554d3b24a5c334d70bfd7ed99b967cccced5c197ef8e23d3bb3a441b9726fc1c413c75a3197

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
101KB

MD5
775f218f1f4e7876ad71f494dee0116c

SHA1
d290dfeb96dbb4d894431d69836de955b549298e

SHA256
45a87f6fa3d2721cc7ba28c6a39949da314962b46035666df3b5994c37f29bd9

SHA512
e8ee06048da734302782a545b3a3a47cd43cbef6aedd283149bea65b9b806923cce148b3d14a071cae5a0ffc478c61f9bb434461f98b3ccd400bf046cd2a45c9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1KB

MD5
e987935c468ee2f82cd6345cf62f9478

SHA1
0e2ee87fe63a92cc75542aa4d9944f1b29114920

SHA256
f9cbe61a3c6e46550ed967099042b923505a4263198c4a3ecf12ab699d11e4a7

SHA512
0e6527cd641270b6fc8495a126be498e061bfc7841e6b36e2c3a048e618ecb7ec52df060f2aa58a4a4bbe701232ea3d0c6d10bb1ef39ce4275cb6c1b25080023

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
143KB

MD5
59640b389bf0c02dfc51e29fdd1372da

SHA1
64a888688a2cbd6ea0225418f51438165b8d2dce

SHA256
f868f5e7dc0a49e190cc0afba00589b470c561cfc0baddf23ac4a5b29ec921b4

SHA512
aad3fecbc237ae92d431ac63ccd0fb46bc4c014f5223ced73c6d2236523ea5104defc57cce2c0d334bc75dd8525ac54238eafc882eed9f34a5f91089d3537b48

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
215KB

MD5
71dd9617f25075d07c452420d33bb381

SHA1
2b7e4168ead11a2aa3b8bf0394449ccee286a596

SHA256
350d2f627702a974fa1a2e29e2a0c2c0750eb08aac432a6e0a66784c0cc20218

SHA512
7876d57add0218e75e4f8e0500b2f901115a3f87b0f25b9fda4df44b7ad1b251641c374056ea1045774bd251cec40eb18901aa7bd25139595994df2b9bc93133

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.2MB

MD5
09df50acc9450fed1ca56b7b7b6801e0

SHA1
561547fe2c305d7bc785e5e7ebf3c14590fbfca5

SHA256
5efb429c8f32145bb941c67b8901101a67de178c8b0042761f0ffa5b69a18d95

SHA512
47aaae8280f508cc24f9d86f16e17d58292c6a4104bb8b0c98c18e4715c3e5c6e5b42634755bd0b233298fb5d18246ca7e9c492a8b1b28a0412bc62ab5049665

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
192KB

MD5
bb5a0e0f70b3f010743122113c57986f

SHA1
7e5f12bd788ac51f6d7a00444dec8eac6d7017ae

SHA256
6a7468bc6e8638625876b74d337fb54dce6eb6884ace33814983f5e1a2a93fd6

SHA512
8f9f98c26eaa43ba227f1a9edf6fe07877e417cd9ebfa4ddfd040a0cf005eaa0fa395faeb3bbafeb0e66cf8c704d82d52acc24405d4cc903d8a7e556b843878c

Download Submit
C:\Windows\System32\alg.exe

Filesize
849KB

MD5
e17d3118efaf9c6cb393eead26bad3bf

SHA1
ab9cbea13c4e6b7f279fa5f56b0b752944c1e285

SHA256
e8211a559ef33e7670ee871d6f3bf62f30f4c61ce598eb58421e2aeba64254b3

SHA512
48a8e3a9056d502dd53866938ae885b29e2bc68b88f3a103c039d249d49e9c438d2b7ee65ab0476c4bde54445301e7b5d652af52a614077a29349f1bd2c1acf0

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
128KB

MD5
a39b5ffdbd5c55193d3e025cd1d41450

SHA1
4df8f6f1056fcf8d6723fca168c98807ba3ff514

SHA256
0aa25f8ebbad7ae1b3c1fa928742a9d30f776fd958c3b55d004da2be6b52daf6

SHA512
eff34588bfe4f9b9781cfbd11bb6208f2c2cd40cc099ffbb09714d1695e0fd1c4039dac6e17a3f9f8c93dee9282e8f0c0207f1f3c21ea892fb9bc3f4b8fc2ba9

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
1.2MB

MD5
c59af438b92a499999ebb4e4789be736

SHA1
8f98da019c93539fce67dcba602bf257fe28f597

SHA256
c8240f116ad22fbebbdeb328fabc665601392df89ff30cd7daae7b0eb22b5fdf

SHA512
f198aa14a6464436ad67346881933b6b6fd8a5c798dd183974f521c8ac1765b742a09d27f37c329ce8e8e8aaf0a62ef7a910594d6fb86ab387933647ae5229d1

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
157KB

MD5
3bc42c3155e4f20c81b524756eeaf387

SHA1
2fd5754bbd1e0d72e5fa4c7b76e036523ac505b8

SHA256
72600c13ec097de699af40bf1fc7636b997b26ea11087661e3f77ccb628f2905

SHA512
5e00aef5fb3163ef52151ff4f3d0933c9bacc8aa7bdea8c21af455909a6907939cb26620ba494b131c1d6855cfc5555f01f8280945c1d8638ea7295dbd4e5c4f

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
128KB

MD5
f47639437c740bd1da889e23e0f61d40

SHA1
eae5923fcdba36aff49a00180656575a62d2963d

SHA256
7d4f390e54ea69d6946f68ff6e9bb9cd523a1ef03ae9efd07fafd9a647574000

SHA512
5ab38835e4fdd643720a032121f46d4cbcf50b67c5b702cd3954cbfeca06b6aefdb1129a400b745f7d378a52c4baaa5f341401096bebef5e3c0f2cb0881c02af

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
371KB

MD5
ec0a56fe616f1ff754e0cdf4ba07e25e

SHA1
83f903ef51a40c8d4ea8f1fc425f17b9a16bdff0

SHA256
b0a01eb86cc3908d9d2c5a3a662a24da3de426d468f938bb38b66db19e63f7c3

SHA512
99b6eb04316a5247b4ff945368fa9f3e4565d5adf6b934d763ee06568bf96321c08b2e1207de9956e66daf82781d61bbbc25922385947ce2d1976b20fe09d304

Download Submit
\Windows\System32\alg.exe

Filesize
1.1MB

MD5
2df520dcb7bf91f46028d99a1ea95566

SHA1
f1d73c7da4d4cbf7e3e8da2503c90b76e953a8fc

SHA256
763850abef71bd3ca67b0eb67ae46f04b66065bf501747c33ee6a3bd271f2284

SHA512
06e1a0256c9866be5f1dfdf0df912a3d5e47677841b7335b07a9858c815b916c2f71c25d65db64dfc854f4b335cfdcc8b84ebd4539bbce70a9cc750f2fc4928f

Download Submit
\Windows\System32\dllhost.exe

Filesize
384KB

MD5
35608f9bee02e34d8e2923819910d256

SHA1
2f35ad865f54ac88eb62e4fe9495e709d95d74d6

SHA256
6446e16dd3c339715470639b0f01c0d5643af0e59f4d4aa8ed1ae0f02875a6f5

SHA512
ca8b7a297cd7f8e77f3868cfff02a2cccd5095ea7c501a90cd52e8adae432172c733f3db02eef2f2cb6679fdac458208b1cd96a557bd07577abe49f2fbec321e

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
215KB

MD5
094af6feb84837aaf21de1be7890a67a

SHA1
6bda1a8c669c6c849c5ad4c72564b50dcbdad615

SHA256
61438a55caea28ed87731df197002c2beb507dbf600086eda3597d01e3f55022

SHA512
79a534daf4800e529eaff2d564f0d608769e4407da145372eee3105f73472fcb0e106c66df191abf19f3c4ee1bfb98f3d4cf68bd1121fd0c93da70243330d3e8

Download Submit
memory/296-467-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/296-461-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/296-455-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/296-446-0x0000000000720000-0x0000000000787000-memory.dmp

Filesize
412KB

Download
memory/672-132-0x0000000000690000-0x00000000006F7000-memory.dmp

Filesize
412KB

Download
memory/672-127-0x0000000000690000-0x00000000006F7000-memory.dmp

Filesize
412KB

Download
memory/672-263-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/672-126-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1140-445-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1140-406-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1140-447-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1140-413-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1140-390-0x0000000000310000-0x0000000000377000-memory.dmp

Filesize
412KB

Download
memory/1292-252-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1292-259-0x00000000008A0000-0x0000000000900000-memory.dmp

Filesize
384KB

Download
memory/1292-253-0x00000000008A0000-0x0000000000900000-memory.dmp

Filesize
384KB

Download
memory/1292-318-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1564-275-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Filesize
412KB

Download
memory/1564-264-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Filesize
412KB

Download
memory/1564-274-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1564-328-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1708-141-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1788-295-0x000000002E000000-0x000000002E139000-memory.dmp

Filesize
1.2MB

Download
memory/1840-238-0x0000000100000000-0x0000000100119000-memory.dmp

Filesize
1.1MB

Download
memory/1840-298-0x0000000100000000-0x0000000100119000-memory.dmp

Filesize
1.1MB

Download
memory/1840-244-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/1840-237-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/1980-134-0x0000000010000000-0x000000001012B000-memory.dmp

Filesize
1.2MB

Download
memory/1980-113-0x0000000010000000-0x000000001012B000-memory.dmp

Filesize
1.2MB

Download
memory/2072-1-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2072-0-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/2072-226-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2072-6-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/2072-7-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/2072-140-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2380-506-0x0000000000530000-0x0000000000597000-memory.dmp

Filesize
412KB

Download
memory/2380-537-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2380-511-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2380-536-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2484-460-0x0000000000390000-0x00000000003F7000-memory.dmp

Filesize
412KB

Download
memory/2484-508-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2484-507-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2484-473-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-94-0x0000000140000000-0x0000000140121000-memory.dmp

Filesize
1.1MB

Download
memory/2520-245-0x0000000140000000-0x0000000140121000-memory.dmp

Filesize
1.1MB

Download
memory/2568-352-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2568-346-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2568-301-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2568-509-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2568-316-0x0000000000B50000-0x0000000000BB7000-memory.dmp

Filesize
412KB

Download
memory/2584-330-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2584-504-0x0000000072388000-0x000000007239D000-memory.dmp

Filesize
84KB

Download
memory/2584-329-0x0000000072388000-0x000000007239D000-memory.dmp

Filesize
84KB

Download
memory/2584-319-0x0000000000420000-0x0000000000480000-memory.dmp

Filesize
384KB

Download
memory/2584-468-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2584-307-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2592-214-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2592-150-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2592-285-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2592-232-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2592-250-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2592-247-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/2592-246-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/2684-233-0x0000000100000000-0x0000000100128000-memory.dmp

Filesize
1.2MB

Download
memory/2684-46-0x0000000100000000-0x0000000100128000-memory.dmp

Filesize
1.2MB

Download
memory/2684-45-0x0000000000950000-0x00000000009B0000-memory.dmp

Filesize
384KB

Download
memory/2684-88-0x0000000000950000-0x00000000009B0000-memory.dmp

Filesize
384KB

Download
memory/2752-377-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2752-510-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2752-387-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2752-380-0x0000000000B20000-0x0000000000B87000-memory.dmp

Filesize
412KB

Download
memory/2752-358-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2836-278-0x0000000140000000-0x000000014014E000-memory.dmp

Filesize
1.3MB

Download
memory/2836-287-0x0000000000FF0000-0x0000000001050000-memory.dmp

Filesize
384KB

Download
memory/2836-292-0x0000000140000000-0x000000014014E000-memory.dmp

Filesize
1.3MB

Download
memory/2836-293-0x0000000000FF0000-0x0000000001050000-memory.dmp

Filesize
384KB

Download
memory/2948-123-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/2948-103-0x00000000004D0000-0x0000000000537000-memory.dmp

Filesize
412KB

Download
memory/2948-98-0x00000000004D0000-0x0000000000537000-memory.dmp

Filesize
412KB

Download
memory/2948-97-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response