Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 24, 2021, 11:11 p.m.	June 24, 2021, 11:16 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`6da66d1368f56a0da3977885bfba690b`
SHA256	`23ca438659eed38e5857df7d10c973eeb3670ebf53eba9a082348100dc602bb6`
CRC32	`3E4215FE`
ssdeep	`24576:2cuzdtQcL7DMpl95wjd5Nsp1J4eVzNFq+KjXQu86OmTdDie+0Zy9yUeiIp8sHgiZ:YZtTL7DMpz2BPYJ4yYjv86OmTxQ0y9yL`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

download.exe "C:\Users\test22\AppData\Local\Temp\download.exe"
2416
- KLUpdateSetup.exe "C:\Users\test22\AppData\Local\Temp\KLUpdateSetup.exe" /install "appguid={AB01C5D1-7F78-4A4E-A89B-0415F6466BCA}&needsadmin=True&autoclose=True"
  2228
  - KLUpdate.exe "C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLUpdate.exe" /install "appguid={AB01C5D1-7F78-4A4E-A89B-0415F6466BCA}&needsadmin=True&autoclose=True"
    1444
    - KLUpdate.exe "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /regsvc
      2044
    - KLUpdate.exe "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /regserver
      1120
      - KLUpdateComRegisterShell64.exe "C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe"
        2492
      - KLUpdateComRegisterShell64.exe "C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe"
        3020
      - KLUpdateComRegisterShell64.exe "C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe"
        1032
    - KLUpdate.exe "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi43MSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM2LjcxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezgwQzRGNTdFLTBGRTUtNEQ1Ny1CRTQ4LUM0OUVCODUxRDdDQ30iIHVzZXJpZD0iezVFRDI3NjAzLTAxNDctNDI4NC04MTU3LTA5RkQ2MUZENzg2Rn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkQzQ0I0RTItRjYzRi00OTVCLUJGN0EtNUQ4NDY2Mzc0RDlFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI1IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYuNzEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjkzOCIvPjwvYXBwPjwvcmVxdWVzdD4
      1080
    - KLUpdate.exe "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /handoff "appguid={AB01C5D1-7F78-4A4E-A89B-0415F6466BCA}&needsadmin=True&autoclose=True" /installsource otherinstallcmd /sessionid "{80C4F57E-0FE5-4D57-BE48-C49EB851D7CC}"
      2232

Name	Response	Post-Analysis Lookup
www.google-analytics.com	CNAME www-google-analytics.l.google.com A 142.250.207.78	172.217.174.110
flownetserv.com	A 172.67.223.135 A 104.21.62.122	172.67.223.135
edgedl.me.gvt1.com	A 34.104.35.123	34.104.35.123
accounts.google.com	A 142.250.199.77	172.217.161.45
soloyama.com	A 193.70.47.128 A 46.105.75.100 A 217.182.133.190	217.182.133.190
secure.mywot.com	A 54.158.63.53 A 52.54.193.222	54.158.63.53
r5---sn-3u-bh2d.gvt1.com	CNAME r5.sn-3u-bh2d.gvt1.com A 59.18.44.80	59.18.44.80
_googlecast._tcp.local
dns.google	A 8.8.4.4 A 8.8.8.8	8.8.8.8
api.mywot.com	A 35.83.118.206 A 52.39.82.104	52.39.82.104
r5---sn-3u-bh2lk.gvt1.com	A 59.18.30.144 CNAME r5.sn-3u-bh2lk.gvt1.com	59.18.30.144
static.mywot.com	A 65.8.17.20 A 65.8.17.68 A 65.8.17.96 A 65.8.17.57	13.227.73.65

IP Address	Status	Action
13.225.134.82	Active	Moloch
142.250.196.131	Active	Moloch
142.250.199.77	Active	Moloch
142.250.207.78	Active	Moloch
164.124.101.2	Active	Moloch
172.67.223.135	Active	Moloch
172.217.161.65	Active	Moloch
172.217.26.35	Active	Moloch
172.217.31.131	Active	Moloch
193.70.47.128	Active	Moloch
59.18.30.144	Active	Moloch
59.18.44.80	Active	Moloch
34.104.35.123	Active	Moloch
35.83.118.206	Active	Moloch
52.54.193.222	Active	Moloch
65.8.17.57	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 172.67.223.135:80 -> 192.168.56.101:49221	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.101:49216 -> 172.67.223.135:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49217 -> 172.67.223.135:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49305 -> 193.70.47.128:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49315 -> 172.67.223.135:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49216 172.67.223.135:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	58:02:7f:64:99:8c:33:d7:44:80:ce:b8:4a:40:da:1b:4a:2d:a5:52
TLS 1.2 192.168.56.101:49217 172.67.223.135:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	58:02:7f:64:99:8c:33:d7:44:80:ce:b8:4a:40:da:1b:4a:2d:a5:52
TLS 1.3 192.168.56.101:49300 142.250.199.77:443	None	None	None
TLS 1.3 192.168.56.101:49301 216.58.200.78:443	None	None	None
TLS 1.3 192.168.56.101:49304 59.18.44.80:443	None	None	None
TLS 1.3 192.168.56.101:49306 59.18.30.144:443	None	None	None
TLS 1.3 192.168.56.101:49307 142.250.207.78:443	None	None	None
TLSv1 192.168.56.101:49305 193.70.47.128:443	C=US, O=Let's Encrypt, CN=R3	CN=soloyama.com	2c:79:5b:29:8f:93:e2:61:60:7f:ba:5e:de:b3:cb:de:24:ef:0b:f2
TLS 1.3 192.168.56.101:49317 8.8.8.8:443	None	None	None
TLS 1.3 192.168.56.101:49308 65.8.17.57:443	None	None	None
TLS 1.3 192.168.56.101:49318 8.8.4.4:443	None	None	None
TLS 1.3 192.168.56.101:49319 142.250.196.131:443	None	None	None
TLS 1.3 192.168.56.101:49322 13.225.134.82:443	None	None	None
TLS 1.3 192.168.56.101:49321 172.217.161.65:443	None	None	None
TLS 1.3 192.168.56.101:49324 172.217.26.35:443	None	None	None
TLS 1.2 192.168.56.101:49310 35.83.118.206:443	C=US, O=Amazon, OU=Server CA 1B, CN=Amazon	CN=mywot.com	ae:ee:12:ae:1a:81:d0:1b:e1:c1:0a:da:d9:0c:33:ce:20:b1:e9:50
TLS 1.2 192.168.56.101:49311 52.54.193.222:443	C=US, O=Amazon, OU=Server CA 1B, CN=Amazon	CN=mywot.com	7b:68:a6:5e:ec:e3:81:e6:28:1c:8e:a7:a2:95:28:21:86:b1:ec:df
TLS 1.2 192.168.56.101:49315 172.67.223.135:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	58:02:7f:64:99:8c:33:d7:44:80:ce:b8:4a:40:da:1b:4a:2d:a5:52
TLS 1.3 192.168.56.101:49323 13.225.134.82:443	None	None	None
TLS 1.3 192.168.56.101:49302 216.58.200.78:443	None	None	None
TLS 1.3 192.168.56.101:49320 172.217.26.35:443	None	None	None
TLS 1.3 192.168.56.101:49325 172.217.31.131:443	None	None	None
UNDETERMINED 192.168.56.101:49309 35.83.118.206:443	None	None	None

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 11:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 24, 2021, 11:11 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 24, 2021, 11:11 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST https://flownetserv.com/service/update2
suspicious_features	POST method with no referer header				suspicious_request	POST https://flownetserv.com/service/update2?cup2key=10:2041637316&cup2hreq=c44ca074fab98820e0ddea4abd5bbe7984d55eefb00cbc75bdb2c1c68dce87ec

Performs some HTTP requests (7 events)

request	HEAD http://flownetserv.com/static/media/build/Flow%20Browser%20-%20SearchBip/stable/win/x64/97856822509658/Setup.exe
request	GET http://flownetserv.com/static/media/build/Flow%20Browser%20-%20SearchBip/stable/win/x64/97856822509658/Setup.exe
request	HEAD http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUViMUVlUQ/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx
request	GET http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUViMUVlUQ/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx
request	POST https://flownetserv.com/service/update2
request	POST https://flownetserv.com/service/update2?cup2key=10:2041637316&cup2hreq=c44ca074fab98820e0ddea4abd5bbe7984d55eefb00cbc75bdb2c1c68dce87ec
request	GET https://soloyama.com/app.php?ping=f%3D1%26a%3D3100%26u%3Dfldk-20210619-4126222-fbchff02%26p%3Dpa%26ck%3D430179789257580636%2F

Sends data using the HTTP POST Method (2 events)

request	POST https://flownetserv.com/service/update2
request	POST https://flownetserv.com/service/update2?cup2key=10:2041637316&cup2hreq=c44ca074fab98820e0ddea4abd5bbe7984d55eefb00cbc75bdb2c1c68dce87ec

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 24, 2021, 11:12 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10004000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 11:12 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a22000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 11:11 p.m.	process_identifier: 1444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72662000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 11:11 p.m.	process_identifier: 1444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 11:11 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 11:11 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72662000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (50 out of 71 events)

file	C:\Users\test22\AppData\Local\Temp\KLUpdateSetup.exe
file	C:\Users\test22\AppData\Local\Temp\nsxFA58.tmp\INetC.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLUpdateComRegisterShell64.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_sl.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\psuser.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLCrashHandler.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_id.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_lv.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_de.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_is.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLUpdateBroker.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_nl.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_bn.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_sr.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ta.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_es-419.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_es.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_el.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_te.dll
file	C:\Users\test22\AppData\Local\Temp\nsxFA58.tmp\System.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_fi.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_lt.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_sw.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_hu.dll
file	C:\Program Files (x86)\KL\uninstall.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_mr.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_sv.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_da.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_fr.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_cs.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ko.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_zh-CN.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ja.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_hr.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_fil.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_kn.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_sk.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_uk.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ru.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_pt-BR.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ro.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLUpdateOnDemand.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_tr.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_en.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\KLUpdateCore.exe
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\psuser_64.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_ml.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_am.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_zh-TW.dll
file	C:\Program Files (x86)\KL\Temp\GUM6356.tmp\goopdateres_pl.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\nsxFA58.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\nsxFA58.tmp\INetC.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)

Time & API	Arguments	Status	Return
Process32NextW June 24, 2021, 11:12 p.m.	snapshot_handle: 0x000001c4 process_name: pw.exe process_identifier: 2812	1	1
Process32NextW June 24, 2021, 11:12 p.m.	snapshot_handle: 0x000001c4 process_name: taskhost.exe process_identifier: 2524	1	1
Process32NextW June 24, 2021, 11:12 p.m.	snapshot_handle: 0x000001c4 process_name: download.exe process_identifier: 2416	1	1
Process32NextW June 24, 2021, 11:12 p.m.	snapshot_handle: 0x000001c4 process_name: KLUpdateSetup.exe process_identifier: 2228	1	1
Process32NextW June 24, 2021, 11:12 p.m.	snapshot_handle: 0x000001c4 process_name: KLUpdate.exe process_identifier: 1444	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 24, 2021, 11:11 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 24, 2021, 11:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 24, 2021, 11:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 24, 2021, 11:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 24, 2021, 11:12 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

klupdate.exe

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files (x86)\KL\Update\KLUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi43MSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM2LjcxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezgwQzRGNTdFLTBGRTUtNEQ1Ny1CRTQ4LUM0OUVCODUxRDdDQ30iIHVzZXJpZD0iezVFRDI3NjAzLTAxNDctNDI4NC04MTU3LTA5RkQ2MUZENzg2Rn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkQzQ0I0RTItRjYzRi00OTVCLUJGN0EtNUQ4NDY2Mzc0RDlFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI1IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYuNzEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjkzOCIvPjwvYXBwPjwvcmVxdWVzdD4

Communicates with host for which no DNS query was performed (5 events)

host	13.225.134.82
host	142.250.196.131
host	172.217.161.65
host	172.217.26.35
host	172.217.31.131

Installs itself for autorun at Windows startup (10 events)

service_name	flow	service_path	C:\Program Files (x86)\KL\Update\1.3.36.71\"C:\Program Files (x86)\KL\Update\KLUpdate.exe" \svc
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E12AFBF-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA092DAD-07DF-443D-9A5A-4434474353ED}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06B2AB2A-2D81-467C-9F30-F46C42EB5050}\InProcServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E12AFBF-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA092DAD-07DF-443D-9A5A-4434474353ED}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06B2AB2A-2D81-467C-9F30-F46C42EB5050}\InProcServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E12AFBF-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA092DAD-07DF-443D-9A5A-4434474353ED}\InprocServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06B2AB2A-2D81-467C-9F30-F46C42EB5050}\InProcServer32\(Default)	reg_value	C:\Program Files (x86)\KL\Update\1.3.36.71\psmachine_64.dll

Created a service where a service was also not started (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW June 24, 2021, 11:11 p.m.	service_start_name: start_type: 2 password: display_name: FlowCompanyName 업데이트 서비스 (flow) filepath: C:\Program Files (x86)\KL\Update\1.3.36.71\"C:\Program Files (x86)\KL\Update\KLUpdate.exe" \svc service_name: flow filepath_r: "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /svc desired_access: 983551 service_handle: 0x008db2b8 error_control: 1 service_type: 16 service_manager_handle: 0x008d95c8	1	9286328	0
CreateServiceW June 24, 2021, 11:11 p.m.	service_start_name: start_type: 3 password: display_name: FlowCompanyName 업데이트 서비스 (flowm) filepath: C:\Program Files (x86)\KL\Update\1.3.36.71\"C:\Program Files (x86)\KL\Update\KLUpdate.exe" \medsvc service_name: flowm filepath_r: "C:\Program Files (x86)\KL\Update\KLUpdate.exe" /medsvc desired_access: 983551 service_handle: 0x008db2e0 error_control: 1 service_type: 16 service_manager_handle: 0x008db2b8	1	9286368	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

MicroWorld-eScan	Gen:Variant.Nemesis.1586
FireEye	Gen:Variant.Nemesis.1586
ALYac	Gen:Variant.Nemesis.1586
Zillya	Dropper.Dapato.Win32.81320
Avast	Win32:Malware-gen
Kaspersky	UDS:Trojan-Dropper.Win32.Dapato.qscx
BitDefender	Gen:Variant.Nemesis.1586
Paloalto	generic.ml
Emsisoft	Gen:Variant.Nemesis.1586 (B)
DrWeb	Trojan.Siggen13.47795
McAfee-GW-Edition	Artemis!Trojan
MAX	malware (ai score=86)
AegisLab	Trojan.Win32.Nemesis.4!c
GData	Gen:Variant.Nemesis.1586
McAfee	Artemis!6DA66D1368F5
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (D)

Performs 68 file moves indicative of a ransomware file encryption process (50 out of 68 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll		0	0

Appends a new file extension or content to 68 files indicative of a ransomware file encryption process (50 out of 68 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdate.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdate.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateCore.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLCrashHandler64.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\KLUpdateComRegisterShell64.exe		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_am.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ar.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bg.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_bn.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ca.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_cs.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_da.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_de.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_el.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_en-GB.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_es-419.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_et.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fa.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fi.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fil.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_fr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_gu.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hi.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_hu.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_id.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_is.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_it.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_iw.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ja.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_kn.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ko.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lt.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_lv.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ml.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_mr.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ms.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_nl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_no.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-BR.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_pt-PT.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ro.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_ru.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sk.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sl.dll		0	0
MoveFileWithProgressW June 24, 2021, 11:11 p.m.	newfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll.old flags: 11 oldfilepath_r: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll newfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll.old oldfilepath: C:\Program Files (x86)\KL\Update\1.3.36.71\goopdateres_sr.dll		0	0

download

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All